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CHAPTER ONE 
INTRODUCTION 


I. Introduction 


On September 11, 2001, 19 terrorists hijacked 4 commercial airplanes as 
part of a coordinated terrorist attack against the United States. Two of the 
planes crashed into the World Trade Center Towers in New York City and one 
hit the Pentagon near Washington, D.C. The fourth plane crashed in a field in 
southwestern Pennsylvania. More than 3,000 persons were killed in these 
terrorist attacks. 


On February 14, 2002, the House of Representatives Permanent Select 
Committee on Intelligence and the Senate Select Committee on Intelligence 
began a joint inquiry to address questions related to the September 11 attacks, 
such as “what the Intelligence Community knew prior to September 11 about 
the scope and nature of any possible terrorist attacks... what was done with 
that information” and “how and to what degree the elements of the Intelligence 
Community have interacted with each other, as well as with other parts of the 
federal, state, and local governments, with respect to identifying, tracking, 
assessing, and coping with international terrorist threats.”’ This review 
became known as the Joint Intelligence Committee Inquiry or “the JICI 
review.” 


One of the key questions arising after the attacks was what information 
the Federal Bureau of Investigation (FBI) knew before September 11 that was 
potentially related to the terrorist attacks. On May 21, 2002, Coleen Rowley, 
the Chief Division Counsel in the FBI’s Minneapolis Field Office,* wrote a 13- 
page letter to FBI Director Robert Mueller in which she raised concerns about 
how the FBI had handled certain information in its possession before the 
attacks. Among other things, Rowley discussed the FBI’s investigation of 


' The U.S. “Intelligence Community” is composed of 14 agencies responsible for 
collecting intelligence information on behalf of the government and includes the Federal 
Bureau of Investigation and the Central Intelligence Agency (CIA). 


* The CDC provides legal counsel and advice to field office management, supervisors, 
and agents on administrative and operational matters. 


Zacarias Moussaoui, a French citizen who had been arrested in Minneapolis on 
August 16, 2001. The Minneapolis FBI Field Office had received a telephone 
call from a representative of a flight school reporting suspicions about 
Moussaoui, who was taking flying lessons at the school near Minneapolis. 
Acting on this information, FBI and Immigration and Naturalization Service 
(INS) agents in Minneapolis investigated Moussaoui for possible connections 
to terrorism and discovered that he was in violation of his immigration status. 
As aresult, on August 16, 2001, Moussaoui was taken into custody on 
immigration charges. 


The Minneapolis FBI became concerned that Moussaoui was training to 
possibly commit a terrorist act using a commercial airplane. It therefore 
attempted to investigate his potential links to terrorism. To pursue this 
investigation, the Minneapolis FBI sought a warrant to search Moussaoui’s 
computer and other belongings. However, FBI Headquarters did not believe 
that a sufficient predicate existed to obtain the search warrant, either a criminal 
warrant or a Foreign Intelligence Surveillance Act (FISA) warrant. Moussaoui, 
who was in custody at the time of the September 11 attacks, later was indicted 
and charged as a co-conspirator in the September 11 attacks. 


In her May 21, 2002, letter to the FBI Director, Rowley criticized the FBI 
Headquarters managers who were involved with the Moussaoui investigation 
prior to September 11. FBI Director Mueller subsequently referred Rowley’s 
letter to the Inspector General and asked the Office of the Inspector General 
(OIG) to review the FBI’s handling of the Moussaoui investigation. In 
addition, the Director asked the OIG to review the issues in an Electronic 
Communication (EC) written by an FBI Special Agent in Phoenix (known as 
the Phoenix EC), as well as “any other matters relating to the FBI’s handling of 
information and/or intelligence before September 11, 2001 that might relate in 
some manner to the September 11, 2001 attacks.” 


The Phoenix EC was a memorandum sent by an agent in the FBI’s 
Phoenix office in July 2001 to FBI Headquarters and to the FBI’s New York 
Field Office.’ The Phoenix EC outlined the agent’s theory that there was a 


° This document has commonly been referred to as “the Phoenix memo” or “the 
Phoenix EC.” Throughout this report, we use the term “Phoenix EC” to refer to this 
document. 


coordinated effort by Usama Bin Laden to send students to the United States to 
attend civil aviation universities and colleges for the purpose of obtaining jobs 
in the civil aviation industry to conduct terrorist activity. The EC also 
recommended that FBI Headquarters instruct field offices to obtain student 
identification information from civil aviation schools, request the Department 
of State to provide visa information about foreign students attending U.S. civil 
aviation schools, and seek information from other intelligence agencies that 
might relate to his theory. At the time of the September 11 attacks, little action 
had been taken in response to the Phoenix EC. 


The OIG agreed to conduct a review in response to the FBI Director’s 
request. In conducting our review, OIG investigators also learned that prior to 
the September 11 attacks the Intelligence Community had acquired a 
significant amount of intelligence about two of the hijackers — Nawaf al Hazmi 
and Khalid al Mihdhar.* Well before September 11, 2001, the Intelligence 
Community had discovered that Hazmi and Mihdhar had met with other al 
Qaeda operatives in Malaysia in January 2000. The CIA also had discovered 
that Mihdhar possessed a valid U.S visa and that Hazmi had traveled to the 
United States in January 2000. The FBI contended, however, that it was not 
informed of Mihdhar’s U.S. visa and Hazmi’s travel to the United States until 
August 2001, just before the September 11 attacks. At that time, the FBI had 
initiated an investigation to locate Mihdhar and Hazmi, but the FBI was not 
close to finding them at the time of the September 11 attacks. The OIG also 
learned that Hazmi and Mihdhar had resided in the San Diego area in 2000, 
where they interacted with a former subject of an FBI investigation and lived 
as boarders in the home of an FBI source. The OIG therefore decided to 
include in its review an investigation of the intelligence information available 
to the FBI about Hazmi and Mihdhar before September 11 and the FBI’s 
handling of that intelligence information. 


In December 2002, the JICI released its final report entitled, “Joint 
Inquiry into Intelligence Community Activities before and after the Terrorist 
Attacks of September 11, 2001.” One of the report’s recommendations was for 
the Inspectors General at the Department of Justice (DOJ), CIA, Department of 


4 Mihdhar, Hazmi, and three others hijacked and crashed American Airlines Flight 77 
into the Pentagon. 


Defense, and Department of State to determine whether and to what extent 
personnel at those agencies should be held accountable for any acts or 
omissions with regard to the identification, prevention, and disruption of the 
September 11 terrorist attacks. 


II. OIG investigation 


The OIG’s review focused on the FBI’s handling of the Phoenix EC, the 
Moussaoui investigation, and the intelligence information about Mihdhar and 
Hazmi. To review these issues, the OIG assembled a team of four attorneys, 
three special agents, and two auditors. The team conducted 225 interviews of 
personnel from the DOJ, FBI, CIA, and other agencies. For example, we 
interviewed FBI personnel from FBI Headquarters; from FBI field offices in 
Minneapolis, San Diego, New York, Phoenix, and Oklahoma; and from FBI 
offices overseas. We also interviewed employees from the CIA, the INS, the 
National Security Agency (NSA), and the Federal Aviation Administration 
(FAA). We reviewed over 14,000 pages of documents we obtained from the 
FBI, the CIA, the NSA, and JICI. 


Our review of the FBI’s handling of the Hazmi and Mihdhar matter 
required us to obtain a significant amount of information from the CIA 
regarding its interactions with the FBI on that matter. To conduct our review, 
we thus had to rely on the cooperation of the CIA in providing us access to 
CIA witnesses and documents. We were able to obtain CIA documents and 
interviewed CIA witnesses, but we did not have the same access to the CIA 
that we had to DOJ information and employees. We also note that the CIA 
OIG is conducting its own inquiry of the CIA’s actions with regard to the 
Mihdhar and Hazmi matter. 


III. Organization of the OIG report 


This report is organized into six chapters. Chapter One contains this 
introduction. Chapter Two provides general background on the issues 
discussed in this report. For example, it contains descriptions of key 
terminology, the FBI’s organizational structure, the so-called “wall” that 
separated intelligence and criminal investigations in the FBI and the DOJ, the 
process for obtaining a FISA warrant, and other legal background issues related 
to how the FBI investigated terrorism and intelligence cases before September 
11, 2001. Because the background chapter contains basic terminology and 


concepts, those with more extensive knowledge of these issues may not need to 
read this chapter in full. 


Chapter Three evaluates the FBI’s handling of the Phoenix EC. As an 
initial matter, we provide background on how “leads” were assigned in the FBI 
before September 11, 2001, and we summarize the contents of the Phoenix EC. 
We then describe in detail how the Phoenix EC was handled within the FBI 
before September 11. In the analysis section of Chapter Three, we examine 
problems in how the Phoenix EC was handled, first focusing on the systemic 
problems that affected the way the FBI treated the EC and then discussing the 
performance of the individuals involved with the EC. At the end of the chapter 
we discuss several other pieces of information in the possession of the FBI 
before September 11 that also noted connections of potential terrorists to the 
aviation industry or the use of airplanes. 


Chapter Four examines the FBI’s investigation of Moussaoui, including 
allegations raised by Rowley. In this chapter, we describe in detail the facts 
regarding the FBI’s investigation of Moussaoui, the interactions between the 
Minneapolis FBI and FBI Headquarters on the investigation, the request to 
seek a criminal warrant or a FISA warrant to search Moussaoui’s belongings, 
and the plans to deport Moussaoui. We then provide our analysis of these 
actions. This analysis discusses systemic problems that this case revealed, and 
it also assesses the performance of the FBI employees who were involved in 
the Moussaoui investigation. 


In Chapter Five, we examine the FBI’s handling of intelligence 
information concerning Hazmi and Mihdhar. We found that, beginning in late 
1999 and continuing through September 11, 2001, the FBI had at least five 
opportunities to learn of intelligence information about Mihdhar and Hazmi 
which could have led it to focus on them before the September 11 attacks. In 
this chapter, we describe each of these five opportunities in detail. We 
describe the intelligence information regarding Hazmi and Mihdhar that 
existed at the time, whether the information was made available to the FBI, and 
what additional information about Hazmi and Mihdhar the FBI could have 
developed on its own. In the analysis section of this chapter, we evaluate the 
problems that impeded the FBI’s handling of the information about Hazmi and 
Mihdhar before September 11, and we also address the performance of the 
individuals involved in the Hazmi and Mihdhar case. 


In Chapter Six, we set forth our recommendations for systemic 
improvements in the FBI and we summarize our conclusions. 


The OIG completed a 421-page classified version of this report in July 
2004. At that time, the OIG provided the report, which was classified at the 
TOP SECRET/SCI level, to the National Commission on Terrorist Attacks 
Upon the United States (9/11 Commission). The 9/11 Commission used 
certain information from our report in its final report. In July 2004, we also 
provided our classified report to certain congressional committees with 
oversight of the Department of Justice, including the House of Representatives 
and Senate Committees on the Judiciary, the Senate Select Committee on 
Intelligence, and the House Permanent Select Committee on Intelligence. 


At the request of the Senate Judiciary Committee, the OIG has created 
this 370-page unclassified version of the report. To do so, we worked with the 
FBI, the CIA, and the NSA to delete classified information from our full report. 
However, the substance of the report has not changed, and we believe that this 
unclassified version fairly summarizes the findings of the full report. 


CHAPTER TWO 
BACKGROUND 


I. Introduction 


This chapter provides a description of key terminology, the FBI’s 
organizational structure, and legal background related to an examination of 
how the FBI investigated international terrorism matters before the 
September 11 terrorist attacks.” It also provides a basic overview of the legal 
issues and policies that affected how the FBI typically handled terrorism 
investigations before September 11, 2001.° 


A. Introduction to international terrorism 


The FBI defines terrorism as the unlawful use or threatened use of 
violence committed against persons or property to intimidate or coerce a 
government, the civilian population, or any segment thereof, in furtherance of 
political or social objectives. When such violent acts are carried out by a group 
or individual based and operating entirely within the United States without 
foreign direction, they are considered acts of domestic terrorism, such as the 
April 1995 bombing of the Alfred P. Murrah federal building in Oklahoma 
City, Oklahoma. When such acts are committed by an individual or group 
based or operating outside of the United States, they are considered acts of 
international terrorism, such as the September 11, 2001, attacks on the World 
Trade Center and the Pentagon. See the FBI’s National Foreign Intelligence 
Program Manual, Section 2-1.1. 


According to the FBI, there are three main categories of international 
terrorist threats to U.S. interests: formal, structured terrorist organizations;’ 


> A list of acronyms used in this report is attached in the Appendix. 


ê Those who have such knowledge may not need to read this chapter and can go directly 
to the chapters of the report detailing our investigation of the FBI’s handling of specific 
matters, beginning with Chapter Three’s discussion of the Phoenix EC. 


7 Formal, structured terrorist organizations are those with their own personnel, 
infrastructures, financial arrangements, and training facilities. Such groups include al 
Qaeda, the Palestinian Hamas, the Irish Republican Army, the Egyptian Al-Gama Al- 
(continued) 


state sponsors of international terrorism®*; and loosely affiliated Islamic 
extremists.” According to Dale Watson, the former Executive Assistant 
Director for Counterterrorism, the trend in international terrorism has been a 
shift away from state sponsors of terrorism and formalized terrorist 
organizations towards loosely affiliated religious extremists who claim Islam 
as their faith. 


Among these Islamic extremists is Usama Bin Laden, who heads the al 
Qaeda transnational terrorist network. Al Qaeda leaders were harbored in 
Afghanistan by the Taliban regime from 1996 until the U.S. military operations 
there in 2001. In addition to the September 11 attacks, al Qaeda was 
responsible for the bombing of the U.S.S. Cole in Yemen on October 12, 2000, 
the bombings of the U.S. Embassies in Kenya and Tanzania in August 1998, 
and numerous other terrorist attacks. 


B. The FBI’s role in protecting against international terrorism 


A critical part of the effort to prevent terrorism is the collection of timely 
and accurate intelligence information about the activities, capabilities, plans 
and intentions of terrorist organizations. The U.S. “Intelligence Community” 
is composed of 14 U.S. agencies responsible for collecting intelligence 
information on behalf of the government. 


(continued) 

Islamiyya, and the Lebanese Hizbollah. Hizbollah, for example, carried out numerous 
attacks on Americans overseas, including the October 1983 vehicle bombing of the U.S. 
Marine barracks in Lebanon and the June 1996 bombing of Khobar Towers in Saudi Arabia. 


8 According to the FBI, as of 2001 the primary state sponsors of terrorism were Iran, 
Iraq, Sudan, and Libya. 


° This is sometimes referred to as the “Islamic Jihad Movement” or the “International 
Jihad Movement.” 


10 These 14 agencies are: the CIA, FBI, Defense Intelligence Agency (DIA), National 
Security Agency (NSA), U.S. Army Intelligence, U.S. Navy Intelligence, U.S. Air Force 
Intelligence, U.S. Marine Corps Intelligence, National Geospatial Agency (NGA), National 
Reconnaissance Office (NRO), Department of the Treasury, Department of Energy, 
Department of State, and the Coast Guard. The Director of Central Intelligence (the DCI) 
oversees the Intelligence Community and also serves as the principal advisor to the 
President for intelligence matters and as the Director of the CIA. 


The National Security Act of 1947 created the Central Intelligence 
Agency (CIA) and established it as the United States’ lead intelligence agency. 
The CIA engages primarily in the collection of foreign intelligence 
information, which is information relating to the capabilities, intentions, and 
activities of foreign governments or organizations, including information about 
their international terrorist activities. The Act prohibits the CIA from 
exercising any “police, subpoena, law enforcement powers, or internal security 
functions.” 


The FBI is the nation’s lead agency for the collection of “foreign 
counterintelligence information.”'' According to the Attorney General 
Guidelines in place at the time, which were called the Attorney General 
Guidelines for Foreign Counterintelligence (FCI) Investigations, FCI is 
information relating to espionage and other intelligence activities, sabotage, or 
assassinations conducted by, for, or on behalf of foreign governments or 
organizations, as well as information relating to international terrorist 
activities. Intelligence investigations include investigations of individuals who 
are international terrorists, groups or organizations that are engaged in 
espionage; or groups or organizations that are engaged in international 
terrorism. 


The FBI can initiate an intelligence investigation even if a crime has not 
been committed. For example, the FBI may investigate and collect intelligence 
information about an individual who is believed to be an international terrorist 
or a spy without showing that the individual has participated in any terrorist act 
or actually committed espionage. Intelligence investigations are 
distinguishable from criminal investigations, such as bank robbery or drug 
trafficking investigations, which attempt to determine who committed a crime 
and to have those individuals criminally prosecuted. Prevention of future 
terrorist acts rather than prosecution after the fact is the primary goal of the 
intelligence investigations with respect to international terrorism matters. 


11 The authority for the FBI’s broad mission to act as the nation’s lead domestic 
intelligence agency is set forth most clearly in Presidential Executive Order 12333, 
implemented on December 4, 1981. 


International terrorism could be investigated as both an intelligence 
investigation and as a criminal investigation. When a criminal act, such as the 
bombing of a building, was determined to be an act of international terrorism, 
the FBI could open a criminal investigation and investigate the crime, as it did 
other criminal cases, with the goal of prosecuting the terrorist. At the same 
time, the FBI could open an intelligence investigation of an individual or a 
group to investigate the person’s contacts, the group’s other members, the 
intentions of the individual or the group, or whether any future terrorist act was 
planned.” 


One significant difference between an intelligence investigation and a 
criminal investigation is the legal framework that applies when a physical 
search or electronic surveillance is initiated." In a criminal investigation that 
implicates the privacy interests protected by the Fourth Amendment, the 
general rule is that searches may not be conducted without a warrant issued by 
a magistrate upon a finding that probable cause exists that evidence of a crime 
will be uncovered. When the FBI seeks to conduct electronic surveillance in 
a criminal investigation, the FBI must obtain a warrant by complying with the 
requirements of Title III of the Omnibus Crime Control and Safe Streets Act of 
1968, 18 U.S.C. §§ 2510-2522 (Title III). When a physical search is sought in 


12 The FBI has been assigned “lead agency responsibilities” by the Attorney General to 
investigate “all crimes for which it has primary or concurrent jurisdiction and which involve 
terrorist activities or acts in preparation of terrorist activities within the statutory jurisdiction 
of the United States.” National Security Directive 207, issued in 1986, specifically assigned 
responsibility to the FBI for response to terrorist attacks, stating: “The Lead Agency will 
normally be designated as follows: The Department of Justice for terrorist incidents that 
take place within U.S. territory. Unless otherwise specified by the Attorney General, the 
FBI will be the Lead Agency within the Department of Justice for operational response to 
such incidents.” 


13 After the attacks of September 11, 2001, the FBI significantly changed how it 
investigates international terrorism cases. We discuss those changes throughout this report. 


14 Electronic surveillance includes wiretapping of telephones, installing microphones in 
a house or building, and intercepting computer usage. Electronic surveillance is considered 
a particular kind of search. 


15 There are several exceptions to the warrant requirement that are not material to this 
report. 


10 


a criminal investigation, the FBI also must comply with the requirements of 
Rule 41 of the Federal Rules of Criminal Procedure. 


With respect to an intelligence investigation, however, criminal search 
warrants issued by a magistrate are not required. The courts have long 
recognized the Executive Branch’s claim of inherent constitutional power to 
conduct warrantless surveillance to protect national security.'° However, 
because such authority was abused, Congress created procedures and judicial 
oversight of the Executive Branch’s exercise of this authority with the passage 
of the Foreign Intelligence Surveillance Act of 1978 (FISA).’” 50 U.S.C. 
81801 et seq. FISA requires the FBI to obtain an order from the Foreign 
Intelligence Surveillance Court (FISA Court) upon a showing of probable 
cause to believe that the subject of the surveillance is a foreign government or 
organization engaging in clandestine intelligence activities or international 
terrorism, or is an individual engaging in clandestine intelligence activities or 
international terrorism on behalf of a foreign government or organization." In 
addition, prior to September 11, 2001, the government had to submit a 
certification to the FISA Court that “the purpose” of the surveillance or search 
was collection of “foreign intelligence information.”'? 50 U.S.C. 

§ 1804(a)(7)(E). 


16 The U.S. Constitution, Article II, Section 1, clause 7, supplies the President’s 
constitutional mandate to “preserve, protect and defend the Constitution of the United 
States.” 


17 Among the most notable examples of the Executive Branch’s abuse of this authority 
was action taken in relation to the Watergate scandal. 


18 Prior to September 11, 2001, the FISA Court consisted of seven federal district court 
judges designated by the Chief Justice of the Supreme Court, at least one of whom was a 
member of the federal district court in Washington, D.C. After September 11, 2001, the 
number of FISA Court judges was increased to 11. The government presents applications 
for a court order authorizing electronic surveillance or a physical search to the judges in in 
camera, ex parte proceedings. FISA also created the Foreign Intelligence Surveillance 
Court of Review, which has jurisdiction to review the denial of FISA applications by the 
FISA Court. 


19 The FISA statute provides that the FBI must show that “the target of the electronic 
surveillance is a foreign power or an agent of a foreign power.” 50 U.S.C. § 1804(a). These 
terms and requirements are discussed in more detail in Section IV, A below. 
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II. The FBI’s organizational structure with respect to international 
terrorism 


The FBI’s Counterterrorism Program is responsible for supervising and 
handling FBI terrorism matters. Before September 11, 2001, the 
Counterterrorism Program was housed in the Counterterrorism Division at FBI 
Headquarters.” International terrorism and domestic terrorism were 
subprograms within the Counterterrorism Program. 


A. Counterterrorism Program 


Although the FBI has had primary responsibility since 1986 for 
investigating and preventing acts of terrorism committed in the United States, 
the FBI developed its formal Counterterrorism Program in the 1990s. For 
much of the 1990s, terrorism matters were overseen at FBI Headquarters by 
about 50 employees in the counterterrorism section within the FBI’s National 
Security Division (later called the Counterintelligence Division). The National 
Security Division also managed the FBI’s Foreign Counterintelligence 
Program. According to Dale Watson, former Executive Assistant Director for 
Counterterrorism, in the early 1990s counterterrorism was considered a “low- 
priority program” in the FBI. 


According to Watson’s testimony before the Senate Select Committee on 
Intelligence and the House Permanent Select Committee on Intelligence on 
September 26, 2002, the first attack on the World Trade Center in February 
1993 and the April 1995 bombing of the Alfred P. Murrah Federal Building in 
Oklahoma City, Oklahoma, were “confirmation” that terrorist acts could be 
committed on U.S. soil. Watson testified that the World Trade Center bombing 
in 1993 was a “wake-up call” and that prior to this attack and the Oklahoma 
City bombing “terrorism was perceived as an overseas problem.” 


In addition to the FBI’s counterterrorism efforts, the CIA has for years 
focused on international terrorism in general and Usama Bin Laden in 
particular. In 1986, the CIA established a Counterterrorist Center (CTC) at 


20 The FBI has reorganized its Counterterrorism Program several times since 
September 11, 2001. We provide in this section of the report the description of the 
organization and positions that existed immediately prior to the September 11 attacks. 
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CIA Headquarters after a task force concluded that U.S. government agencies 
had not aggressively operated to disrupt terrorist activities. The CTC’s stated 
mission is to preempt, disrupt, and defeat terrorists by implementing a 
comprehensive counterterrorist operations program to collect intelligence on 
and minimize the capabilities of international terrorist groups and state 
sponsors of terrorism. The CTC attempts to exploit source intelligence to 
produce in-depth analyses on potential terrorist threats and coordinate the 
Intelligence Community’s counterterrorist activities. 


CIA Director George Tenet testified before Congress that Usama Bin 
Laden came to the attention of the CIA as “an emerging terrorist threat” during 
his stay in Sudan from 1991 to 1996. As early as 1993, the CIA began to 
propose action to reduce his organization’s capabilities. Tenet stated that the 
Intelligence Community was taking action to stop Bin Laden by 1996, when he 
left Sudan and moved to Afghanistan. 


In 1996, the CIA established a special unit, which we call the Bin Laden 
Unit, to obtain more actionable intelligence on Bin Laden and his 
organization.’ This effort was the beginning of an exchange program between 
the FBI and the CIA in which senior personnel moved temporarily between the 
two agencies. 


Around the same time, in April 1996 the FBI created its own 
Counterterrorism Center at FBI Headquarters. As part of the Counterterrorism 
Center, the FBI established an exchange of working-level personnel and 
managers with several government agencies, including the CIA, Immigration 
and Naturalization Service (INS), the Federal Aviation Administration (FAA), 
and others. 


In May 1998, a task force of FBI officials created a 5-year strategic plan 
for the FBI, based on a 3-tier system, setting investigative priorities that would 
affect the allocation of FBI resources. Tier 1 included crimes or intelligence 
problems that threatened national or economic security. Counterterrorism was 


?1 The Bin Laden Unit was housed organizationally within the CTC during the time 
period most relevant to this report. Around September 11, 2001, approximately 40-50 
employees worked in the Bin Laden Unit. We discuss the Bin Laden Unit in more detail in 
Chapter Five. 
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designated a Tier 1 priority. Tier 2 involved criminal enterprises or those 
offenses that adversely affected public integrity, and Tier 3 included crimes 
that affected individuals or property. 


In November 1999, the FBI took the Counterterrorism Program out of the 
National Security Division and created a separate Counterterrorism Division. 


1. Organization of the Counterterrorism Division 


The major components of the FBI’s Counterterrorism Division prior to 
September 11, 2001, were the International Terrorism Operations Section 
(ITOS), the Domestic Terrorism Operations Section (DTOS), the National 
Infrastructure Protection Center (NIPC), and the National Domestic 
Preparedness Office (NDPO).” 


The issues in this report focus primarily on ITOS, which was responsible 
for overseeing the FBI’s international terrorism investigations, both criminal 
and intelligence investigations. The mission of the ITOS was twofold: to 
prevent terrorist acts before they occurred, and if they occurred to mount an 
effective investigative response with the goal of prosecuting those responsible. 


Prior to September 11, 2001, approximately 90 employees worked in 
ITOS at FBI Headquarters. ITOS was led by Section Chief Michael Rolince 
during the time relevant to this report. 


ITOS was divided into several units. One of those units handled Bin Laden- 
related investigations, and was called the Usama Bin Laden Unit or the UBLU. 
Cases that could not be linked to a specific group and that involved radical 


* The NIPC, created in February 1998, was originally called the Computer 
Investigation and Infrastructure Threat Center. The NIPC’s mission was to serve as the U.S. 
government’s focal point for threat assessment, warning, investigation, and response for 
threats or attacks against the nation’s critical infrastructures. These infrastructures include 
telecommunications, energy, banking and finance, water systems, government operations, 
and emergency services. The NDPO was created in October 1998 to coordinate all federal 
efforts to assist state and local law enforcement agencies with the planning, training, and 
equipment needs necessary to respond to a conventional or non-conventional weapons of 
mass destruction incident. The NIPC has since been moved to the Department of Homeland 
Security. The responsibilities for the NDPO were moved to the Federal Emergency 
Management Agency before September 11, 2001. 
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extremist allegations were assigned to Radical Fundamentalist Unit or the 
RFU. Before September 11, it had approximately ten employees. 


2. Management of counterterrorism cases at FBI Headquarters 


FBI Headquarters was more closely involved in overseeing 
counterterrorism investigations compared to criminal cases such as bank 
robberies or white collar crime. In counterterrorism cases, FBI Headquarters 
was responsible for, among other things, ensuring that intelligence information 
received from outside agencies was provided to the relevant field offices and 
assisting field offices in preparing the paperwork necessary to apply for a FISA 
order. For this reason, we discuss the duties of the relevant personnel at FBI 
Headquarters with respect to counterterrorism investigations. 


a. Supervisory Special Agents and Intelligence Operations 
Specialists 


Each of the five units within ITOS was staffed by several Supervisory 
Special Agents (SSA), each of whom worked closely with Intelligence 
Operations Specialists (IOS). The SSAs were FBI agents who had several 
years of experience in the field and had been promoted to a supervisory 
headquarters position. These SSAs generally worked in ITOS for 
approximately two years before becoming supervisors in a field office or 
elsewhere in FBI Headquarters. ITOS SSAs typically had at least some 
experience in terrorism matters prior to coming to ITOS. 


IOSs were non-agent, professional employees.” Some had advanced 
degrees in terrorism or terrorism-related fields. Others had no formal training 
in analytical work but advanced to their IOS positions from clerical positions 
within the FBI. Most IOSs were long-term employees who were expected to 
have institutional knowledge about terrorism matters, such as the history of a 
particular terrorist organization or the principal participants in a terrorist 
organization. 


23 In October 2003, the FBI reclassified all FBI analysts under one position title — 
Intelligence Analyst. IOSs now are called “Operations Specialists.” 
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The responsibilities of each SSA and IOS depended on the unit in which 
they worked. Some SSAs and IOSs oversaw all FBI investigations relating to a 
particular terrorist group or a particular target. Other SSAs and IOSs were 
responsible for overseeing terrorism investigations conducted in a particular 
region of the country. 


SSAs and IOSs were the first point of contact for agents and supervisors 
in the field conducting counterterrorism investigations when approval, advice, 
or information was needed. For example, if a field office’s investigation 
revealed connections between the subject of the investigation and a known 
leader of a terrorist organization, the IOS was supposed to provide the field 
office with the FBI’s information on the leader of the terrorist organization. In 
addition, SSAs and IOSs assisted field offices by assembling the necessary 
documentation to obtain court orders authorizing electronic surveillance 
pursuant to FISA. This is discussed further in Section IV, B below. 


SSAs and IOSs also were responsible for collecting and disseminating 
intelligence and threat information. They received information from various 
FBI field offices and from other intelligence agencies that needed to be 
analyzed and disseminated to the field. SSAs and IOSs also acted as liaisons 
with other intelligence agencies. They also received information from these 
agencies in response to name check requests or traces on telephone numbers as 
well as intelligence and threat information. 


With respect to threat information, SSAs and IOSs worked with FBI field 
offices or Legal Attaché (Legat) offices to assess the threat and take any action 
necessary to prevent terrorist acts from occurring.” For example, an IOS 
would conduct research on the names associated with the threats, arrange for 
translators to translate any intercepts from electronic surveillance, request 
information from other agencies about the persons associated with the threats, 
and prepare communications to the field office and Legat to ensure that 


** Prior to September 11, 2001, the FBI had 44 Legat offices around the world. Legat 
offices assist the FBI in its mission from outside of the United States by, for example, 
coordinating with other government agencies to facilitate the extradition of terrorists wanted 
for killing Americans. As of June 2004, the FBI had 45 Legat offices and four Legat sub- 
offices. 
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updated information was provided to the necessary persons involved in the 
investigation. 


b. Intelligence Research Specialists and analysis within the 
Counterterrorism Division 


Prior to September 11, 2001, Intelligence Research Specialists (IRSs) 
also were a part of the FBI’s Counterterrorism Program, although they were 
housed in a separate division of the FBI from the SSAs and IOSs. Both IRSs 
and IOSs performed an important function in the intelligence arena called 
“analysis.” 


Analysis is the method by which pieces of intelligence information are 
evaluated, integrated, and organized to indicate pattern and meaning. As 
information is received, it must be examined in-depth and connected to other 
pieces of information to be most useful. 


Analysis generally is considered to be either tactical or strategic. Tactical 
analysis, which also is called operational analysis, directly supports 
investigations or attempts to resolve specific threats. It normally must be acted 
upon quickly to make a difference with respect to an investigation or a threat. 
An example of tactical analysis is the review of the telephone records of 
several subjects to determine who might be connected to whom in a certain 
investigation or across several investigations. Another example of tactical 
analysis is a review of case files to determine whether similar, suspicious 
circumstances in two unrelated police reports exist in other cases and are 
somehow connected to each other or to criminal or terrorist activity. 


In contrast to tactical analysis, strategic analysis provides a broader view 
of patterns of activity, either within or across terrorism programs. Strategic 
analysis involves drawing conclusions from the available intelligence 
information and making predictions about terrorist activity. It is not simply 
descriptive but proactive in nature. A typical product of strategic analysis is a 
report that includes program history, shifts in terrorist activity, and conclusions 
about how the FBI should respond. 


The FBI has acknowledged that prior to September 11, 2001, its 
Counterterrorism Division was primarily geared toward conducting tactical 


17 


analysis in support of operational matters rather than strategic analysis.” 
Tactical analysis generally was handled by [OSs within the operational units. 


Prior to September 11, strategic analysis for the Counterterrorism 
Division was performed by IRSs. Like IOSs, IRSs were non-agent, 
professional employees who were expected to be subject matter experts about a 
particular terrorism group, program, or target. All IRSs at the FBI had college 
degrees, and some had advanced degrees. Like IOSs, IRSs were expected to be 
long-term FBI employees who possessed the “institutional knowledge” about a 
particular program or target.” 


During the time period relevant to our review, IRSs who worked 
counterterrorism matters were assigned to the Investigative Services Division 
(ISD), a division separate from the Counterterrorism Division that contained all 
IRSs in the FBI. IRSs were grouped in units and reported to a unit chief, who 
reported to a section chief. The IRSs who were assigned to the FBI’s 
Counterterrorism Program typically worked with the same SSAs and IOSs 
assigned to a particular terrorist group or target. For example, an IRS who was 
assigned to Bin Laden matters typically worked with IOSs and SSAs in the 
UBLU in ITOS. 


As we discuss in detail in Chapter Three, the number of FBI IRSs 
decreased significantly before September 11, 2001, and the relatively few IRSs 
were often used to perform functions other than strategic analysis. 


Many FBI analysts and supervisors noted to the OIG that the resources 
devoted to the Counterterrorism Program and analysis were inadequate, and 
that the amount of work in the Counterterrorism Program was overwhelming. 
They also stated that they were hampered significantly by inadequate 
technology. We discuss these issues in further detail in Chapter Three of the 
report on the handling of the Phoenix EC. However, these difficult conditions 
in the Counterterrorism Program apply equally to the issues in the other 
chapters in our report. 


°° In Chapter Three, we discuss in more detail the FBI’s lack of strategic analysis 
capabilities prior to September 11, 2001. 


26 TRSs now are called “All Source Analysts.” 
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B. Field offices and counterterrorism investigations 


Prior to September 11, 2001, FBI counterterrorism investigations, 
whether intelligence or criminal, were opened and led by the FBI’s 56 field 
offices. In many field offices, counterterrorism investigations were handled by 
a squad that focused on terrorism cases only. In the New York Field Office 
and other large offices, several squads were devoted solely to international 
terrorism matters. In smaller field offices, international terrorism and domestic 
terrorism investigations often were assigned to the same squad. FBI agents 
generally developed specialties within the terrorism field such as a particular 
terrorist organization. Each squad was led by an SSA who reported to an 
Assistant Special Agent in Charge (ASAC) who, in turn, reported to the 
Special Agent in Charge (SAC).”” 


As stated above, field offices opened international terrorism 
investigations as either a criminal investigation or an intelligence investigation. 
Attorney General Guidelines delineated the information or allegations that 
were necessary to open a criminal investigation or an intelligence 
investigation.”° 


For both criminal and intelligence cases, the Attorney General Guidelines 
set forth the criteria for opening two levels of investigations — a “preliminary 
inquiry” (PI) and a “full investigation” (also called a full field investigation or 
FFI). The Guidelines also specified what investigative techniques could be 
employed in preliminary inquiries or full investigations. Both sets of the 


?7 Tn larger field offices such as New York, several SACs report to an Assistant Director 
in Charge (ADIC). 


?8 Separate Attorney General Guidelines regulate the FBI’s conduct in criminal 
investigations, intelligence investigations, and the handling of informants, among other 
issues. The Attorney General Guidelines that addressed criminal investigations were called 
“The Attorney General’s Guidelines on General Crimes, Racketeering Enterprise and 
Domestic Security/Terrorism Investigations” (hereinafter “criminal AG Guidelines”). The 
Attorney General Guidelines in effect at the time that addressed intelligence investigations 
were labeled “Attorney General Guidelines for FBI Foreign Intelligence Collection and 
Foreign Counterintelligence Investigations” (hereinafter “FCI AG Guidelines”). Revised 
criminal Attorney General Guidelines were issued on May 30, 2002, and new FCI 
Guidelines were issued on October 31, 2003. 
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Guidelines provided that preliminary inquiries were conducted to determine 
whether a basis existed for a full investigation. However, preliminary inquiries 
had to be closed when there was insufficient information after a certain period 
of time to support opening a full field investigation. 


With respect to intelligence cases, agents could collect information by, 
among other methods, questioning sources, finding new sources, checking FBI 
and other agency databases, and reviewing intelligence information from other 
intelligence agencies. Information was recorded in the form of Electronic 
Communications (ECs) that became part of the case file. An EC is the 
standard form of communication within the FBI. 


Before September 11, 2001, FBI international terrorism intelligence cases 
contained the case identifier number 199. Letter or “alpha” designations were 
also used, along with the case identifier, to further identify intelligence 
investigations. For example, intelligence investigations related to a particular 
terrorist organization were designated as 199N investigations. International 
terrorism intelligence investigations often are referred to as “a 199.” A 
criminal international terrorism investigation had the FBI case identifier 
number 265; these investigations were commonly referred to as “a 265.”” 


C. The Department’s Office of Intelligence Policy and Review 


As mentioned above, when the FBI conducts intelligence investigations, 
a significant tool for uncovering information is the FISA statute. The FBI 
obtains an order from the FISA Court authorizing electronic surveillance and 
searches with the assistance of Department attorneys in the Office of 
Intelligence Policy and Review (OIPR). OIPR is under the direction of the 
Counsel for Intelligence Policy.” 


? Currently, the FBI uses only one designation for international terrorism 
investigations. 


30 We discuss in detail the process for obtaining FISA warrants and the role of FBI and 
OIPR personnel in this process in Section IV, B. 
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HI. The wall between intelligence and criminal terrorism investigations 


A. Introduction 


This section summarizes the creation of the “wall” separating criminal 
and intelligence terrorism investigations in the Department of Justice. The wall 
began as a separation of intelligence investigators from contact with criminal 
prosecutors, and evolved to include a separation of FBI investigators working 
on intelligence investigations from investigators working on criminal 
investigations. 


As discussed above, FBI terrorism investigations could be opened either 
as an intelligence investigation in which information was collected for the 
protection of national security, or as a criminal investigation to prevent a 
criminal act from occurring or to determine who was responsible for a 
completed criminal act. In the course of an intelligence investigation, 
information might be developed from searches or electronic surveillance 
obtained under FISA. That intelligence information also could be relevant to a 
potential or completed criminal act. However, concerns were raised that if 
intelligence investigators consulted with prosecutors about the intelligence 
information or provided the information to criminal investigators, this 
interaction could affect the prosecution by allowing defense counsel to argue 
that the government had misused the FISA statute and it also could affect the 
intelligence investigation’s ability to obtain or continue FISA searches or 
surveillances. As a result, procedural restrictions — a wall — were created to 
separate intelligence and criminal investigations. Although information could 
be “passed over the wall” — i.e., shared with criminal investigators — this 
occurred only subject to defined procedures. 


The wall separating intelligence and criminal investigations affected both 
the Moussaoui case and the Hazmi and Mihdhar case. As we discuss in detail 
in Chapter Four, in the Moussaoui case FBI Headquarters believed that the 
Minneapolis agents should not contact the local U.S. Attorney’s Office to seek 
a criminal warrant to search Moussaoui’s possessions because, under the 
standards prior to September 11, 2001, contact with the local prosecutor would 
undermine any later attempt to obtain a FISA warrant. And as we discuss in 
detail in Chapter Five, because of the wall — and beliefs about what the wall 
required — an FBI analyst did not share important intelligence information 
about Hazmi and Mihdhar with criminal investigators. In addition, also 
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because of the wall, in August 2001 when the New York FBI learned that 
Hazmi and Mihdhar were in the United States, criminal investigators were not 
allowed to participate in the search for them. 


Because the wall between intelligence and criminal investigations 
affected these two cases, we provide in this section a description of how the 
wall was created and evolved in response to the 1978 FISA statute. We also 
describe the unwritten policy separating criminal and intelligence 
investigations in the 1980s and early 1990s, the 1995 Procedures that codified 
the wall, the FISA Court procedures in 2000 that required written certification 
that the Department had adhered to the wall between criminal and intelligence 
investigations, and the changes to the wall after the September 11 attacks. 


1. The “primary purpose” standard 


The FISA statute, enacted in 1978, authorizes the FISA Court to grant an 
application for an order approving electronic surveillance or a search warrant 
to obtain foreign intelligence information if there is probable cause to believe 
that the target of the surveillance or search warrant is a foreign power or an 
agent of a foreign power. 50 U.S.C. § 1805(a)(3). The statute requires that the 
government certify when seeking the warrant that “the purpose” of the FISA 
search or surveillance is to obtain “foreign intelligence information.” The 
statute states that the certification must be made “by the Assistant to the 
President for National Security Affairs or an executive branch official or 
officials designated by the President from among those executive officers 
employed in the area of national security or defense and appointed by the 
President with the advice and consent of the Senate.” 50 USC § 1804(a)(7). 
Within the Department, the certification is usually signed by the FBI Director. 


While Congress anticipated that evidence of criminal conduct uncovered 
during FISA surveillance would be provided to criminal investigators, the 
circumstances under which such information could be furnished to criminal 
investigators were not provided for in the statute.” Defendants in criminal 


31 The legislative history states that “surveillance to collect positive foreign intelligence 
may result in the incidental acquisition of information about crimes; but this is not its 
objective.” Further, it states, “Surveillance conducted under [FISA] need not stop once 
conclusive evidence of a crime is obtained, but instead may be extended longer where 
(continued) 
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cases can challenge the government’s use of information collected under a 
FISA warrant by arguing that the government’s purpose in obtaining the 
information pursuant to FISA was not for collection of foreign intelligence, but 
rather for use in a criminal prosecution. Such a purpose would violate the 
Fourth Amendment’s prohibition against warrantless searches, and could result 
in evidence obtained under FISA being suppressed in the criminal case. 
Alternatively, the FISA Court could reject an application for a FISA warrant 
because of concerns that the government’s purpose for seeking the FISA 
warrant was for use in a criminal case rather than collecting foreign 
intelligence. 


As aresult, in interpreting FISA courts applied “the primary purpose” 
test. This allowed the use of FISA information in a criminal case provided that 
the “primary purpose” of the FISA surveillance or search was to collect foreign 
intelligence information rather than to conduct a criminal investigation or 
prosecution. The seminal court decision applying this standard to information 
collected in intelligence cases was issued in 1980. See United States v. Truong 
Dinh Hung, 629 F.2d 908 (4" Cir. 1980). In this case, the Fourth Circuit Court 
of Appeals ruled the government did not have to obtain a criminal warrant 
when “the object of the search or the surveillance is a foreign power, its agents 
or collaborators,” and “the surveillance is conducted ‘primarily’ for foreign 
intelligence purposes.” Id. at 915. However, the court ruled that the 
government’s primary purpose in conducting an intelligence investigation 
could be called into question when prosecutors had begun to assemble a 
prosecution and had led or taken on a central role in the investigation. 


Although the Truong decision involved electronic surveillance conducted 
before FISA’s enactment in 1978, courts used its reasoning and applied the 
primary purpose test in challenges in criminal cases to the use of information 
gathered from searches or electronic surveillance conducted pursuant to FISA. 
See, e.g., United States v. Johnson, 952 F.2d 565 (1“ Cir. 1991), cert. denied, 
113 S.Ct. 58 (1992) (“[a]lthough evidence obtained under FISA subsequently 
may be used in criminal prosecutions, the investigation of criminal activity 


(continued) 
protective measures other than the arrest and prosecution are more appropriate.” S. 1566, 
95™ Congress, 2d Session, Report 95-701, March 14, 1978. 
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cannot be the primary purpose of the surveillance”); United States v. Pelton, 
835 F.2d 1067 (4" Cir. 1987), cert. denied, 486 U.S. 1010 (1988). 


In the 1980s, the Department also adopted the “primary purpose” 
standard contained in the Truong case.” It interpreted the FISA statute as 
requiring prosecutors not to have control in intelligence investigations in which 
information was being collected pursuant to FISA. The concern was that too 
much involvement by prosecutors in the investigation created the risk that a 
court would rule that the FISA information could not be used in a criminal case 
because the “primary purpose” of the search was not the gathering of foreign 
intelligence. 


As a result, during the 1980s and through the mid-1990s, the 
Department’s policy was that prosecutors within the Department’s Criminal 
Division — not attorneys in the local United States Attorneys’ Offices (USAOs) 
— had to be consulted in connection with intelligence investigations in which 
federal criminal activity was uncovered, or when legal advice was needed to 
avoid investigative steps that might inadvertently jeopardize the option of 
prosecution using information obtained from the intelligence investigation. 
Criminal Division attorneys were briefed by the FBI about ongoing intelligence 
investigations and were expected to provide advice geared toward preserving a 
potential criminal case, but they were not allowed to exercise control over the 
investigation. The Criminal Division and FBI Headquarters made the policy 
decision about when to involve the USAO in the investigation, since consulting 
with the USAO was viewed as a bright line signifying the transition from an 
intelligence investigation to a criminal investigation. However, during this 
time period, no formal written guidelines governed the contacts between the 
FBI and the Criminal Division. 


32 The Foreign Intelligence Surveillance Court of Review later noted that while the 
Department adopted this policy in the 1980s, “the exact moment is shrouded in historical 
mist.” See In Re Sealed Case, 310 F.3d 717, 727 (2002). 
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2. Institutional divide between criminal and intelligence 
investigations 


The effect on FISA warrants or the legal restrictions on sharing 
intelligence information was not the only issue regarding sharing intelligence 
information with criminal investigators. Agents conducting intelligence 
investigations are generally wary about the impact of sharing intelligence 
information with prosecutors and criminal investigators. They expressed 
concerns about potential harm that disclosure would have on intelligence 
sources and methods, and the damage that such disclosure would have on 
future collection of intelligence information. Intelligence collection is 
dependent upon secrecy; investigators often rely upon clandestine sources or 
surveillance techniques that are rendered useless if they are exposed. In 
addition, most of the information collected is classified and cannot be made 
public. In contrast, criminal investigations are usually intended to result in a 
prosecution, which may require the disclosure of information about the source 
of evidence relied upon by the government. Thus, intelligence investigators’ 
need to protect secret sources and methods may be at odds with criminal 
investigators’ use of the information derived from those sources and methods. 


3. The Ames case and concerns about the primary purpose 
standard 


In February 1994, CIA employee Aldrich Ames was arrested on various 
espionage charges. The FBI pursued an investigation regarding Ames that 
involved several certifications to the FISA Court that the purpose of electronic 
surveillance was for intelligence purposes. At the time of the ninth 
certification in the Ames case, Richard Scruggs, the new head of OIPR, was 
concemed that no guidelines governed the contacts between the Criminal 
Division and the FBI that were permitted in intelligence investigations. 
Scruggs raised concerns with the Attorney General that the primary purpose 
requirement and FISA statute had been violated by the extensive contacts 
between the Criminal Division and the FBI in the Ames investigation. 


To address these concerns about coordination between the Criminal 
Division and the FBI in intelligence investigations, in 1994 Scruggs proposed 
amending the Attorney General’s FCI Guidelines to require that any questions 
in intelligence investigations relating to criminal conduct or prosecutions had 
to be raised first with OIPR, and that OIPR would decide whether and to what 
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extent to involve the Criminal Division and the USAO in the intelligence 
investigation. Scruggs’ proposal also prohibited the FBI from contacting the 
Criminal Division or a USAO without permission from OIPR. 


In one memorandum, Scruggs described this separation of criminal and 
intelligence investigations as a wall: “The simple legal response to parallel 
investigations is a ‘Chinese Wall’ which divides the attorneys as well as the 
investigators.” Scruggs’ use of the term “Chinese wall” is the first reference 
we found to the term “wall” in connection with separating intelligence and 
criminal investigations. In another memorandum discussing his proposal, 
Scruggs wrote that the goal of the changes was “not to prevent discussions with 
the Criminal Division” but “to regulate them so as to place the Department in 
the best possible legal posture should prosecution be undertaken.” In addition, 
he wrote that the goal was to develop “a simple mechanism” to maintain the 
legal distinction between criminal investigations and intelligence operations. 


Scruggs’ proposal generated considerable controversy within the 
Department and the FBI. The Criminal Division and the FBI wrote position 
papers opposing the proposal. Although the Criminal Division and the FBI 
both agreed that some formal procedures were necessary to guard against 
abuses in the use of FISA and to rebut unwarranted claims of abuse, they 
argued that allowing OIPR to decide when prosecutors could be consulted was 
unnecessary and unduly burdensome, and would deter useful and productive 
contacts between investigators and prosecutors.” The Criminal Division also 
argued that it was “imperative” for any procedures to “allow for potential 
criminal prosecutions to be protected through early evaluation and guidance” 
and advocated continuing the requirement that the Criminal Division had to be 
advised any time the FBI uncovered evidence of federal criminal activity in the 
course of an intelligence investigation. 


Also in response to Scruggs’ proposal, the Executive Office for National 
Security, which was located in the Deputy Attorney General’s Office, sought 
an opinion from the Office of Legal Counsel (OLC) whether a search under 


33 The FBI agreed, however, that the rule preventing contact with a United States 
Attorney’s Office without approval from the Criminal Division and OIPR should remain. 
The FBI stated that “the requisite sensitivity to these concerns and experience with treading 
this fine line will often be absent” in U.S. Attorney’s Offices. 
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FISA could be approved “only when the collection of foreign intelligence 
[was] the ‘primary purpose’ of the search or whether it suffic[ed] that the 
collection of foreign intelligence [was] one of the purposes.” Ina 
memorandum that was circulated in draft in mid-January 1995, OLC concluded 
that while courts had adhered to — and were likely to continue to adhere to — the 
“primary purpose” test with regard to FISA information, the courts had shown 
great deference to the government in challenges to evidence gathered through 
intelligence searches that was used in criminal prosecutions. OLC opined that 
some involvement of prosecutors could be permitted to be involved with the 
FISA searches without running an “undue risk” of having evidence suppressed, 
but that there were “few bright line rules” for discerning when a “‘primarily’ 
intelligence search becomes a ‘primarily’ criminal investigation search.” OLC 
wrote, “[I]t must be permissible for prosecutors to be involved in the searches 
at least to the extent of ensuring that the possible criminal case not be 
prejudiced.” At the end of its opinion, OLC recommended that “an appropriate 
internal process be set up to insure that FISA certifications are consistent with 
the ‘primary purpose’ test.” 


4. The 1995 Procedures 


a. Creation of the 1995 Procedures 


In late December 1994, at the direction of Deputy Attorney General 
Jamie Gorelick, the Executive Office for National Security convened a 
working group to resolve the dispute between OIPR and the FBI and the 
Criminal Division concerning contacts between the FBI and the Criminal 
Division. The Criminal Division, OIPR, the FBI, OLC, and the Executive 
Office for National Security participated in the group. As a result of 
discussions within the working group, on February 3, 1995, the Executive 
Office for National Security circulated draft procedures for contacts between 
the FBI and prosecutors. The draft procedures, “Procedures for Contacts 
Between the FBI and the Criminal Division Concerning Foreign Intelligence 
and Foreign Counterintelligence Investigations,” were transmitted on April 12, 
1995, by the Executive Office for National Security through the Deputy 
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Attorney General to the Attorney General for approval and implementation.** 
The Attorney General signed and issued the procedures on July 19, 1995. 
These procedures became known as “the 1995 Procedures.” 


b. Description of the 1995 Procedures 


In general, the 1995 Procedures rejected OIPR’s original proposal of 
giving it the sole authority to decide when FBI agents could consult with 
Criminal Division prosecutors on an intelligence investigation. However, the 
1995 Procedures gave OIPR formal oversight over contacts between the FBI 
and the Criminal Division in intelligence cases, and the procedures formalized 
restrictions on the extent that Criminal Division prosecutors could be involved 
in intelligence investigations. The procedures applied to intelligence 


34 At the time these draft procedures were being discussed, the FBI’s New York Field 
Office was conducting at least two significant criminal terrorism investigations involving the 
World Trade Center bombing in 1993. Indictments had been returned in one of the cases. 
During the criminal investigation of these two cases, significant counterintelligence 
information was developed relating to foreign powers operating in the United States, and the 
FBI initiated a full field counterintelligence investigation. In a memorandum written to the 
FBI, the Southern District of New York (SDNY) USAO, OIPR, and the Criminal Division, 
and filed with the FISA Court on March 4, 1995, Deputy Attorney General Gorelick 
provided instructions for sharing information from these two terrorism investigations in the 
FBI’s New York Field Office with intelligence investigators, and for separating the 
counterintelligence and criminal investigations. The memorandum stated that the 
procedures were designed to prevent the risk of creating an unwarranted appearance that 
FISA was being used to avoid the procedural safeguards that applied in criminal 
investigations. The memorandum, which acknowledged that the procedures went “beyond 
what [was] legally required,” included having an Assistant United States Attorney (AUSA) 
not involved in the criminal cases but who was familiar with them act as “the wall” as well 
as ensure that information indicative of a crime obtained in the intelligence investigation 
was passed to the criminal agents, the USAO, and the Criminal Division. The memorandum 
also included several procedures to facilitate coordination and information sharing, 
including requiring intelligence investigators who developed information that reasonably 
indicated the commission of a crime to notify law enforcement agents and assigning an FBI 
agent involved in the criminal investigation to be assigned to the foreign counterintelligence 
investigation. 
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investigations both in which a FISA search or surveillance was being 
conducted and in which no FISA order had been issued.” 


The 1995 Procedures formalized the unwritten policy that had existed 
since the 1980s requiring the Criminal Division, rather than the local USAO, to 
be consulted about intelligence investigations when questions of criminal 
activity or criminal prosecution arose.” The 1995 Procedures required that the 
FBI and OIPR notify the Criminal Division when “facts or circumstances 
[were] developed that reasonably indicate[d] that a significant federal crime 
[had] been, [was] being, or [might have been] committed.” 


In cases in which FISA surveillance was being conducted, the 1995 
Procedures provided that OIPR as well as the Criminal Division had to approve 
an FBI field office’s request to take an investigation to the USAO. Guidance 


3 Part A of the 1995 Procedures applied to investigations in which a FISA order had 
been issued, and Part B applied to those investigations in which no FISA order had been 
issued. 


°° However, there was an exception for the USAO in the Southern District of New York 
(SDNY). While the 1995 Procedures were being considered in draft, Deputy Attorney 
General Gorelick had recommended that they be reviewed by U.S. Attorney for the SDNY 
Mary Jo White. White responded that the USAOs should be on equal footing with the 
Criminal Division, and she recommended changes to the 1995 Procedures to achieve this, 
such as requiring in intelligence cases notification of a crime to both the Criminal Division 
and to the USAO. White argued that “[a]s a legal matter, whenever it is permissible for the 
Criminal Division to be in contact with the FBI, it is equally permissible for the FBI to be in 
touch with the U.S. Attorneys’ Offices.” This suggestion was unanimously rejected by the 
FBI, OIPR, the Criminal Division, and the Executive Office for National Security, and the 
exception was not included in the 1995 Procedures. However, White continued to press this 
issue. In a memorandum faxed to Gorelick on December 27, 1995, White argued that the 
Department and the FBI were structured and operating in a way that did not make maximum 
legitimate use of all law enforcement and intelligence avenues to prevent terrorism and 
prosecute terrorist acts. She asserted that the 1995 Procedures were building “unnecessary 
and counterproductive walls that inhibit rather than promote our ultimate objectives” and 
that “we must face the reality that the way we are proceeding now is inherently and in 
actuality very dangerous.” Eventually, on August 29, 1997, the Attorney General issued a 
memorandum creating a special exemption for the SDNY USAO in cases in which no FISA 
techniques were being employed. In those cases, the FBI was permitted to notify directly 
the SDNY USAO of evidence of a crime, and the USAO then was required to involve the 
Criminal Division and OIPR. 
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issued by the FBI Director that accompanied the 1995 Procedures instructed 
FBI field offices that any potential contact with prosecutors (either the 
Criminal Division or requests to consult with the USAO) had to be coordinated 
through FBI Headquarters. 


In cases in which no FISA warrant had been issued, the 1995 Procedures 
required that the Criminal Division decide when it was appropriate to involve 
the USAO in the intelligence investigation, although notice of the decision had 
to be given to OIPR. For example, as discussed in Chapter Four, the FBI 
Minneapolis Field Office opened the Moussaoui investigation as an 
intelligence investigation, but then wanted to seek a criminal search warrant 
from the USAO. Since an intelligence investigation was opened but no FISA 
warrant had been issued, the Minneapolis FBI needed permission — which it 
was required to obtain through FBI Headquarters — from the Criminal Division 
in order to approach the USAO for a criminal search warrant. 


Under the 1995 Procedures, the Criminal Division was responsible for 
notifying OIPR of, and giving OIPR an opportunity to participate in, all of the 
Criminal Division’s consultations with the FBI concerning intelligence 
investigations in which a FISA warrant had been obtained. In intelligence 
investigations where no FISA warrant had been obtained, the Criminal 
Division had to provide notice to OIPR of its contacts with the FBI. In both 
types of cases, the FBI was required to maintain a log of all its contacts with 
the Criminal Division. 


The 1995 Procedures provided that in intelligence investigations the 
Criminal Division could give advice to the FBI “aimed at preserving the option 
of a criminal prosecution,” but could not “instruct the FBI on the operation, 
continuation, or expansion of FISA electronic surveillance or physical 
searches.” In addition, the FBI and the Criminal Division were required to 
ensure that the advice intended to preserve the prosecution did not 
“inadvertently result in either the fact or the appearance of the Criminal 
Division’s directing or controlling [the investigation] toward law enforcement 
objectives.” 


5. Additional restrictions on sharing intelligence information 


In addition to the wall between FBI intelligence investigators and 
criminal prosecutors, a wall within the FBI between criminal investigations and 
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intelligence investigations also was created. Although it is unclear exactly 
when this wall within the FBI began, sometime between 1995 and 1997 the 
FBI began segregating intelligence investigations from criminal investigations 
and restricting the flow of information between agents who conducted 
intelligence investigations and agents who conducted criminal investigations. 


As discussed above, in a position paper prepared by OIPR when the 
Department was considering the 1995 Procedures, OIPR recommended that the 
FBI be required to open separate and parallel criminal and intelligence 
investigations, and that the FBI place “a wall” between the two investigations 
by staffing the criminal investigation with FBI agents who did not have access 
to the intelligence investigation. This wall was intended to ensure that 
information from each investigation would be fully admissible in the other. 
OIPR proposed certain procedures for sharing information developed in the 
intelligence investigation that was relevant to the criminal investigation, a 
process that was referred to as “passing information over the wall.” 


The process for passing information from the intelligence investigation to 
the criminal investigation was that an FBI employee — usually the SSA of an 
international terrorism squad, the Chief Division Counsel of a field office, or 
an FBI Headquarters employee — would be permitted to review raw FISA 
intercepts or materials seized pursuant to a FISA and act as a screening 
mechanism to decide what to “pass” to the criminal investigators or 
prosecutors. 


In March 1995, at the direction of the Department, the FBI established 
special “wall” procedures for the New York Field Office’s handling of the 
criminal and intelligence investigations that arose out of the 1993 World Trade 
Center bombing. It is unclear when similar procedures were employed 
throughout the FBI. By 1997 OIPR was including a description of the 
screening or “wall” procedures in all FISA applications that were filed with the 
FISA Court when a criminal investigation was opened.” The particular 


37 Neither OIPR nor the FBI had any written policy requiring the inclusion of such 
information in FISA applications until late 2000, after the discovery of several errors in 
FISA applications related to information about criminal investigations and wall procedures 
related to those criminal investigations. These errors are discussed below in Section II, B 
of this chapter. 
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screening mechanism proposed by OIPR and approved by the Attorney 
General depended on how far the criminal investigation had developed.” If the 
case had recently been initiated, the SSA was usually the screener. In a case in 
which the USAO already was involved, others could be the screener, such as 
an attorney in the FBI’s Office of General Counsel, OIPR, or the Attorney 
General. According to James Baker, the current OIPR Counsel,” in late 1999 
the Department proposed the use of the FISA Court as “the wall.” The purpose 
of this proposal was to ensure that the FISA Court would approve FISA 
applications related to threats involving the Millennium where there was a 
substantial nexus with related criminal cases. 


6. Reports evaluating the impact of the 1995 Procedures 


Although the 1995 Procedures allowed for consultation between the FBI 
and the Criminal Division about intelligence investigations, and in some 
instances required contact by the FBI with the Criminal Division, the FBI 
dramatically reduced its consultations with the Criminal Division after the 
1995 Procedures were issued. The FBI came to understand from OIPR that 
any consultation with Criminal Division attorneys could result in a FISA 
surveillance being terminated or in OIPR not agreeing to pursue a FISA 
warrant. As aresult, the FBI sought prosecutor input only after it was prepared 
to close an intelligence investigation and “go criminal.” 


Three reports — a July 1999 OIG report on the Department’s campaign 
finance investigation, a May 2000 Department report on the Wen Ho Lee case, 
and a July 2001 General Accounting Office (GAO) report — discussed these 
issues and the impact of the 1995 Procedures and the wall. 


38 According to OIPR Counsel Baker, Attorney General Janet Reno directed the 
termination of certain FISA surveillances in 1998 based upon her determination that related 
criminal investigative activities called into question the primary purpose of the surveillance 
collection. 


3 Baker joined OIPR in October 1996 and became the Deputy Counsel in 1998. In 
May 2001, he was named Acting Counsel, and in January 2002 he became the Counsel. 
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a. The OIG’s July 1999 report on the campaign finance 
investigation 


The first report was the OIG’s July 1999 report entitled “The Handling of 
FBI Intelligence Information Related to the Justice Department’s Campaign 
Finance Investigation” (the Campaign Finance Report). The OIG report 
reviewed allegations that the FBI had failed to disclose certain intelligence 
information to Congress, FBI Director Louis Freeh, and Attorney General Janet 
Reno. This intelligence information related to the FBI’s Campaign Finance 
Task Force, which had been created to investigate allegations of campaign 
finance violations during the 1996 presidential campaign. In connection with 
this review, the OIG examined issues concerning the implementation of the 
1995 Procedures and the sharing of intelligence information with prosecutors 
and criminal investigators. 


The OIG report found that the 1995 Procedures were largely 
misunderstood and often misapplied, resulting in undue reluctance by 
intelligence agents to provide information to criminal investigators and 
prosecutors. The report stated that “the tumult that accompanied [the] creation 
[of the 1995 Procedures] drastically altered the relationship between [the FBI] 
and prosecutors.” The report found that because of OIPR’s criticism of the FBI 
during the Ames investigation, FBI agents had become “gun shy” about 
conversations with Criminal Division attorneys, and the FBI’s General 
Counsel’s Office had recommended that FBI agents take a “cautious approach” 
by initially conferring with OIPR attorneys rather than Criminal Division 
attorneys. The report also noted that as a result of the FBI’s concerns about 
OIPR’s criticisms, the FBI had been “needlessly chilled” from sharing 
intelligence information with the Criminal Division. The report stated that the 
1995 Procedures were vaguely written and provided ineffective guidance for 
the FBI. The report recommended that the Criminal Division, OIPR, and the 
FBI resolve conflicting understandings about the 1995 Procedures, and the FBI 
issue guidance to disabuse FBI personnel of “unwarranted concerns about 
contact with prosecutors.” 


b. The report of the Attorney General’s Review Team on 
the Wen Ho Lee investigation 


The second report addressing these issues was prepared by the Attorney 
General’s Review Team (AGRT), which the Department established to review 
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the handling of the Wen Ho Lee investigation.“ A chapter of the final AGRT 
report, issued in May 2000, discussed the 1995 Procedures. The AGRT report 
found that soon after the 1995 Procedures were implemented, OIPR prevented 
the FBI from contacting the Criminal Division in contravention of the 
requirements of the procedures. The report stated that FBI and Criminal 
Division officials believed that OIPR was discouraging contact by the FBI with 
the Criminal Division. Both FBI and Criminal Division officials believed that 
such contact would jeopardize existing or future FISA coverage because OIPR 
might not present the matter to the FISA Court or the FISA Court would deny 
the request if such contact occurred. The report stated, “It is clear from 
interviews that the AGRT has conducted that, in any investigation where FISA 
is employed or even remotely hoped for (and FISA coverage is always hoped 
for), the Criminal Division is considered radioactive by both the FBI and 
OIPR.” 


The AGRT report noted that OIPR Counsel Scruggs made it clear to the 
FBI that it was not permitted to contact prosecutors in FCI investigations 
without the permission of OIPR. The report stated that, as a result, former FBI 
Deputy Director Robert Bryant communicated to FBI agents that violating this 
rule was a “career stopper.” 


In October 1999, the AGRT made interim recommendations to the 
Attorney General. For example, the AGRT recommended that the FBI provide 
“regularly scheduled briefings” to the Criminal Division concerning FCI 
investigations that had the potential for criminal prosecution. 


In response, in January 2000 Attorney General Reno established the 
“Core Group,” which consisted of the FBI’s Assistant Directors for 
counterterrorism and counterintelligence, the Principal Associate Deputy 
Attorney General, and the Counsel for OIPR. The FBI was supposed to 
provide monthly “critical case briefings” to the Core Group, and the Core 
Group was supposed to decide if the facts of the cases warranted notification to 
the Criminal Division as provided for in the 1995 Procedures. In addition, the 


4 The team was led by Randy Bellows, an AUSA from the Eastern District of Virginia 
who was experienced in FCI cases. The AGRT report, which is entitled “Final Report of the 
Attorney General’s Review Team on the Handling of the Los Alamos National Laboratory 
Investigation,” is often called “the Bellows report.” 
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Attorney General directed the FBI to provide the Criminal Division with copies 
of foreign counterintelligence case memoranda summarizing espionage 
investigations of U.S. citizens or lawful permanent residents. 


In October 2000, the Core Group was disbanded because it was believed 
that the briefings were duplicative of sensitive case briefings that the FBI 
provided to the Attorney General and the Deputy Attorney General on a 
quarterly basis. Around the same time a working group that had been formed 
months earlier in response to the interim recommendations of the AGRT report 
developed two decision memoranda for the Attorney General’s approval, one 
in October 2000 and one in December 2000. The memoranda included several 
options for addressing the FBI’s lack of notification to the Criminal Division 
regarding evidence in intelligence investigations of significant federal crimes 
and the lack of coordination with the Criminal Division, and they delineated 
the type and extent of advice the Criminal Division could provide the FBI. The 
December 2000 memorandum also described a strategy for presenting new 
procedures for coordination between intelligence and law enforcement to the 
FISA Court, and it discussed the possibility of an appeal to the FISA Court of 
Review if the FISA Court rejected the new coordination procedures. Although 
the Criminal Division, OIPR, and the FBI reached an agreement on steps to 
liberalize information sharing, the components could not agree on what kind of 
advice by the Criminal Division to the FBI was permissible. The Attorney 
General never issued or signed either memorandum. 


c. The GAO report 


In the third report, the GAO reviewed the policies, procedures, and 
processes for coordinating FBI intelligence investigations where criminal 
activity was indicated. In its July 2001 report, the GAO found that the FBI had 
little contact with the Criminal Division about intelligence investigations 
because of the FBI and OIPR’s concern about the potential for “rejection of the 
FISA application or the loss of a FISA renewal” or “suppression of evidence 
gathered using FISA tools.” See “FBI Intelligence Investigations: 
Coordination within Justice on Counterintelligence Criminal Matters is 
Limited,” GAO-01-780, July 2001. The GAO report recommended, among 
other things, that the Attorney General establish a policy and guidance 
clarifying the expectations regarding the FBI’s notification of the Criminal 
Division about potential criminal violations arising in intelligence 
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investigations. According to the GAO report, while there were some 
improvements in the coordination between the FBI and the Criminal Division 
after the remedial actions in response to the AGRT report were implemented, 
coordination impediments remained. 


B. FISA Court’s concern about accuracy of FISA applications 


1. Errors in FISA applications 


Around the time of these two reviews on problems of coordinating 
criminal and intelligence information, the FISA Court imposed additional 
restrictions on the passing of intelligence information to criminal investigators. 
The FISA Court took this action after it learned in 2000 and 2001 of errors in 
approximately 100 FISA applications that had been filed with the Court.“ 
Approximately 75 of the errors were contained in FISA applications relating to 
targets with connections to a particular terrorist organization, which we will 
call “Terrorist Organization No. 1,” and the other errors were contained in 
FISA applications relating to a different terrorist organization, which we will 
call “Terrorist Organization No. 2.” 


In the summer of 2000, OIPR first learned of the errors in several FISA 
applications related to Terrorist Organization No.1. OIPR verbally notified the 
FISA Court of the errors and, together with FBI Headquarters employees, 
conducted a review of other FISA applications involving Terrorist 
Organization No. 1 that had been submitted since July 1997. In September and 
October 2000, OIPR filed two pleadings with the FISA Court advising of 
errors in approximately 100 FISA applications related to Terrorist Organization 
No. 1. 


*" As discussed in detail below, FISA applications were submitted by field offices to 
FBI Headquarters for preparation of the documentation that would be presented to OIPR for 
finalization and submission to the FISA Court. The documentation prepared by FBI 
Headquarters and finalized by OIPR often was reviewed or edited by different persons, 
including an SSA, IOS, Unit Chief, and a National Security Law Unit attorney. The 
documentation included an affidavit signed by the SSA at FBI Headquarters containing the 
facts in support of the FISA warrant. The errors arose in these SSA affidavits. 
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Many of these errors in the FISA applications involved omissions of 
information or misrepresentations about criminal investigations on the FISA 
targets. In applications where criminal investigations were identified, 
inaccurate information was presented in FISA applications about the “wall” 
procedures to separate the criminal investigation from the intelligence 
investigation. For example, the description of the wall procedures in the 
majority of FISA applications involving Terrorist Organization No. 1 stated 
that the FBI New York Field Office had separate teams of agents handling the 
criminal and intelligence investigations. While different agents were assigned 
to the criminal and intelligence investigations, they were not kept separate from 
each other. Instead, the criminal agents worked on the intelligence 
investigation, and the intelligence agents worked on the criminal investigation. 
This meant that, contrary to what had been represented to the FISA Court, 
agents working on the criminal investigation had not been restricted from the 
information obtained in the intelligence investigation. 


2. FISA Court’s new requirements regarding the wall 


As aresult of the FISA Court’s concerns about the mistakes in the FISA 
applications, the FISA Court began requiring in October 2000 anyone who 
reviewed FISA-obtained materials or other intelligence acquired based on 
FISA-obtained intelligence (called “FISA-derived” intelligence’’) to sign a 
certification acknowledging that the Court’s approval was required for 
dissemination to criminal investigators. The FBI came to understand that this 
meant that only intelligence agents were permitted to review without FISA 
Court approval all FISA intercepts and materials seized by a FISA warrant, as 
well as any CIA and NSA intelligence provided to the FBI based on 
information obtained by an FBI FISA search or intercept.” 


Because FISA-obtained information often was passed from the FBI to the 
NSA and the CIA, the Department asked the FISA Court whether the FBI was 


4 FISA-obtained information was often passed to the NSA and CIA for further use, 
which could result in “FISA-derived” information. 


43 As stated above, in late 1999, the Court had become the screening mechanism or “the 
wall” for all investigations involving FISA techniques on al Qaeda in which the FBI wanted 
to pass intelligence information to a criminal investigation. 
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also required to obtain the newly required certifications from any NSA or CIA 
employees who reviewed the FISA-obtained material. The Court exempted the 
NSA and CIA from the certification, but required that the two agencies note on 
any intelligence shared with the FBI if it was FISA-derived. According to the 
NSA, when made aware of this requirement, it reported to the Department that, 
in the interest of providing as much intelligence as quickly as possible to the 
FBI, the NSA would place a caveat on all counterterrorism-related intelligence 
provided to the FBI. The caveat indicated that if the FBI wanted to pass NSA 
intelligence to criminal investigators, it had to involve the NSA General 
Counsel’s Office to determine whether the information was in fact FISA- 
derived. According to the NSA, the other alternative would have been to slow 
the dissemination while the NSA checked whether the intelligence was derived 
from a FISA.“ 


The caveat language used by the NSA stated: “Except for information 
reflecting a direct threat to life, neither this product nor any information 
contained in this product may be disseminated to U.S. criminal investigators or 
prosecutors without prior approval of NSA. All subsequent product which 
contains information obtained or derived from this product must bear this 
caveat. Contact the Office of General Counsel of NSA for guidance 
concerning this caveat.” ® 


“4 This was not the first caveat on dissemination of NSA information. In late 1999, 
Attorney General Reno authorized a warrantless physical search under authority granted to 
the Attorney General by Section 2.5 of Executive Order 12333, unrelated to FISA. The 
Attorney General directed that the fruits of the physical search could not be disseminated to 
any criminal prosecutors or investigators until copies of the information were provided to 
OIPR and the approval of the Attorney General had been obtained. Questions were raised 
about dissemination of NSA’s information based upon the fruits of a Section 2.5 search. 
The NSA — after working with OIPR to determine what language to use — decided to put a 
caveat on all of its Bin Laden related reporting to the FBI indicating that further 
dissemination to law enforcement entities could not occur without approval from OIPR. 


4 In Chapter Five, the chapter about Hazmi and Mihdhar, we discuss the separation of 
criminal investigators from intelligence investigators and the requirement that NSA 
information be reviewed by the NSA to determine whether it was FISA-derived or otherwise 
subject to limited dissemination. We describe how these restrictions affected the FBI’s 
ability to share important intelligence information. For example, in early summer 2001 an 
FBI Headquarters IOS met with New York criminal agents who were working on the FBI’s 
(continued) 
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3. Additional FISA errors and DOJ OPR’s investigation 


The Deputy Attorney General’s Office referred to the DOJ Office of 
Professional Responsibility (OPR) a memorandum prepared by OIPR 
regarding the errors in the approximately 75 Terrorist Organization No. 1- 
related FISA applications that had been raised to the FISA Court. In 
November 2000, OPR opened an investigation to determine whether any FBI 
employees had committed misconduct in connection with these errors. 


In March 2001, OIPR also became aware of an error in a FISA 
application related to Terrorist Organization No. 2. The error concerned the 
description of the wall procedures in several FBI field offices. This description 
also had been used in 14 other applications related to Terrorist Organization 
No. 2. After the FISA Court learned of these errors, it stated that it would no 
longer accept any FISA application in which the supporting affidavit was 
signed by the SSA who had presented that Terrorist Organization No. 2 FISA 
application to the Court. 


To address the issue of the accuracy of the information in the FISA 
affidavits, FBI ITOS managers began requiring that FISA affidavits contain 
certain information, such as the signature of the field office SSA and any 
AUSA involved in the case indicating that they had read the affidavit and 
agreed with the facts as they were written. In April 2001, the entire FBI 
Counterterrorism Division was instructed to comply with these procedures. On 
May 18, 2001, the Attorney General issued additional instructions to improve 
the accuracy of FISA affidavits, including requiring direct communication 
between OIPR attorneys and the field office on whose behalf the FISA 
application was being prepared and establishing a FISA training program at the 
FBI’s training academy in Quantico, Virginia. In addition, the Attorney 


(continued) 

Cole investigation. During this meeting, they discussed certain information obtained from 
the CIA about Mihdhar. Although the IOS had information from the NSA about Mihdhar, 
the IOS did not reveal this information to the FBI criminal agents at the meeting because it 
had not yet been approved for dissemination by the NSA. In addition, in August 2001, once 
the FBI opened an intelligence investigation to locate Mihdhar, the same IOS and a New 
York criminal agent involved in the earlier meeting discussed and disagreed about whether a 
criminal agent would be permitted to participate in the intelligence investigation trying to 
locate Mihdhar or to participate in any interview with Mihdhar. 
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General asked OPR to expand its investigation to include a review of the errors 
made in FISA applications related to Terrorist Organization No. 2. 


OPR’s report, which was issued on May 15, 2003, concluded that “none 
of the errors in the [Terrorist Organization No. 1] and [Terrorist Organization 
No. 2] related FISA applications were the result of professional misconduct or 
poor judgment by the attorneys or agents who prepared or reviewed them.” 
The report concluded that “a majority of the errors were the result of systemic 
flaws in the process by which those FISA applications were prepared and 
reviewed.” These systemic flaws included, among other things, a lack of a 
formal training program for attorneys in OIPR or agents at the FBI to learn 
about the FISA application process, a lack of policies or rules regarding the 
required content of FISA applications, and a lack of resources for handling 
FISA applications. 


C. Deputy Attorney General Thompson’s August 2001 
memorandum 


On August 6, 2001, Deputy Attorney General Larry Thompson issued a 
memorandum to the Criminal Division, OIPR, and the FBI regarding the 
Department’s policies governing intelligence sharing and establishing new 
policy. It stated that the 1995 Procedures and the additional 2000 procedures 
remained in effect. The memorandum stated that “the purpose of this 
memorandum is to restate and clarify certain important requirements imposed 
by the 1995 Procedures, and the [January 2000 measures issued in response to 
the AGRT report], and to establish certain additional requirements.” 


The memorandum reiterated the requirement that the Criminal Division 
had to be notified when there were facts or circumstances “that reasonably 
indicate that a significant federal crime has been, is being or may be 
committed.” The memorandum emphasized the notification was mandatory 
and that the “reasonable indication” standard was “substantially lower than 
probable cause.” 


In addition, the memorandum stated that the FBI was required to have 
monthly briefings with the Criminal Division on all investigations that met the 
notification standards. The memorandum added that the Criminal Division 
should identify the investigations about which it needed additional information, 
and the FBI was required to provide this information. The memorandum did 
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not address the issue of the type of advice that was permissible by Criminal 
Division attorneys to the FBI. 


D. The impact of the wall 


The actions of the Department, including OIPR, the implementation of 
the 1995 Procedures, the additional requirements created by the FISA Court, 
and the OPR investigation had several effects on the handling of intelligence 
and criminal investigations. First, witnesses told the OIG that the concerns of 
the FISA Court, the banning of the SSA from the FISA Court, the OPR 
investigation, and the additional requirements for sharing information imposed 
by the FISA Court contributed to a climate of fear in ITOS at FBI 
Headquarters. SSAs and IOSs at FBI Headquarters were concerned about 
becoming the subject of an OPR investigation and the effect that any such 
investigation would have on their careers. 


They said they were concerned not only about the accuracy of the 
information they provided to the Court, but also about ensuring that 
intelligence information was kept separate from criminal investigations. A 
former ITOS Unit Chief and long-time FBI Headquarters SSA told the OIG 
that the certification requirement was referred to as “a contempt letter.” He 
explained that FBI employees began fearing that they would lose their jobs if 
any intelligence information was shared with criminal investigators. 


Second, the restrictions imposed by the FISA Court — the requirement 
that anyone who received intelligence sign the certification and the screening 
procedures applicable to both FISA-obtained and FISA-derived material — 
created administrative hurdles for the FBI in handling intelligence information. 
For example, the new requirements were imposed in December 2000, just two 
months after the bombing of the U.S.S. Cole, and during the time the FBI was 
actively pursuing its criminal investigation. Given the new requirements, the 
FBI employed several IOSs on the Cole investigation just to track all of the 
required certifications. 


Consistent with the conclusions of the AGRT report, employees at FBI 
Headquarters and in the Minneapolis Field Office who we interviewed told us 
that before September 11, 2001, there was a general perception within the FBI 
that seeking prosecutor input or taking any criminal investigative step when an 
intelligence investigation was open potentially harmed the FBI’s ability to 
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obtain, maintain, or renew a FISA warrant. FBI Headquarters employees 
described cases in which OIPR required that electronic surveillance obtained 
under FISA be “shut down” and that the FBI “go criminal” because permission 
had been requested to approach the USAO or because some other criminal step 
had been taken. In addition, FBI attorneys told the OIG that, in their 
experience, OIPR would not consider applying for a FISA warrant in a case in 
which OIPR determined that there was “too much” criminal activity. 


OIPR Counsel Baker told the OIG that the primary concern of the FISA 
Court was the direction and control of the intelligence investigation by 
prosecutors, not sharing of intelligence information with law enforcement 
agents. Baker stated that the FISA Court had approved FISA applications in 
which there was extensive interaction between prosecutors and FBI agents, 
provided that OIPR was present during the interactions, there was a separation 
between the prosecutors and intelligence investigators, and that the FISA Court 
was apprised of the FBI’s intended use of the FISA information. 


E. Changes to the wall after September 11, 2001 


Shortly after the September 11, 2001, terrorist attacks, the Department 
proposed lowering the wall between criminal and intelligence information by 
changing the language in the FISA statute from “the purpose” of the 
surveillance or search (for the collection of foreign intelligence information) to 
only “a purpose.”*° In October 2001, the Uniting and Strengthening America 
by Providing Appropriate Tools Required To Intercept and Obstruct Terrorism 
Act (the USA PATRIOT Act or the Patriot Act) was enacted, which changed 
the requirement from “the purpose” (for obtaining foreign intelligence) to “a 
significant purpose.” Pub. L. No. 107-56, 115 Stat. 272, Section 218. The 
Patriot Act also specified that federal officers who conduct electronic 
surveillance or searches to obtain foreign intelligence information may consult 


46 The Department had been considering seeking this change to FISA prior to 
September 11. In August 2001, the Office of the Deputy Attorney General asked the Office 
of Legal Counsel (OLC) for advice on whether FISA could be amended by Congress to 
require that the collection of foreign intelligence information be “a purpose” of a FISA 
warrant rather than “the purpose.” That request was under review by OLC on September 11, 
2001. 
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with federal law enforcement officers to coordinate their efforts to investigate 
and protect against actual or potential attacks, sabotage, or international 
terrorism. Id. at Section 504. 


Although the Patriot Act amendments to FISA expressly provided for the 
consultation and coordination between prosecutors and FBI intelligence 
investigators, in November 2001 the FISA Court issued an order requiring that 
the 1995 Procedures, as revised by Attorney General Reno’s January 2000 
changes and the August 2001 Thompson memorandum, be applied in all cases 
before the FISA Court. 


In March 2002, the Attorney General issued new guidelines on 
intelligence sharing procedures that superseded the 1995 Procedures. The 
2002 Procedures effectively removed “the wall” between intelligence and 
criminal investigations. The 2002 Procedures explained that since the Patriot 
Act allowed FISA to be used for a “significant purpose” rather than the 
primary purpose of obtaining foreign intelligence, FISA could “be used 
primarily for a law enforcement purpose, as long as a significant foreign 
intelligence purpose remain[ed].” (Emphasis in original.) 


The 2002 Procedures also directed that the Criminal Division and OIPR 
shall have access to — and that the FBI shall provide — all information 
developed in full field foreign intelligence and counterintelligence 
investigations, particularly information that is necessary to the ability of the 
United States to investigate or protect against foreign attack, sabotage, 
terrorism, and clandestine intelligence activities; and information that concerns 
any crime which has been, is being, or is about to be committed. The 2002 
Procedures provided that USAOs should receive information and engage in 
consultations to the same extent as that provided for the Criminal Division. 


In addition to these information sharing requirements, the 2002 
Procedures provided that intelligence and law enforcement officers may 
exchange a “full range of information and advice” concerning foreign 
intelligence and foreign counterintelligence investigations, “including 
information and advice designed to preserve or enhance the possibility of a 
criminal prosecution.” The 2002 Procedures noted that this extensive 
coordination was permitted because the Patriot Act provided that such 
coordination shall not preclude the government’s certification of a significant 
foreign intelligence purpose for the issuance of a warrant by the FISA Court. 
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The Department immediately tested the new 2002 Procedures with the 
FISA Court. In an opinion issued on May 17, 2002, the FISA Court accepted 
the information-sharing provisions of the new Procedures. However, the FISA 
Court rejected the Department’s position that criminal prosecutors should be 
permitted to have a significant role in FISA surveillances and searches from 
start to finish. See In Re All Matters Submitted to Foreign Intelligence 
Surveillance Court, 218 F.Supp.2d 611 (2002). The Department appealed the 
Court’s ruling to the Foreign Intelligence Surveillance Court of Review, the 
appellate court for the FISA Court. This was the first appeal ever to the FISA 
Court of Review. 


The Court of Review rejected the FISA Court’s findings, as well as the 
1995 Procedures and the “primary purpose standard” that had been applied 
before the Patriot Act revision. See In Re Sealed Case, 310 F.3d 717 (2002). 
The Court of Review concluded that the restrictions of the wall imposed by the 
Department and the FISA Court were never required by FISA or the 
Constitution.” The Court ruled that FISA permitted the use of intelligence in 
criminal investigations, and that coordination between criminal prosecutors and 
intelligence investigators was necessary for the protection of national security. 
The Court concluded that while the FBI had to certify that the purpose of the 
FISA surveillance was to obtain foreign intelligence information, FISA did not 
preclude or limit the use of intelligence information in a criminal prosecution. 
The Court wrote, “[E]ffective counterintelligence, we have learned, requires 
the wholehearted cooperation of all the government’s personnel who can be 
brought to the task.” Id. at 743. 


IV. The process for obtaining a FISA warrant 


In this section, we describe the legal and procedural requirements for 
obtaining a FISA warrant prior to September 11, 2001, focusing on the 
requirement for a warrant to conduct a physical search like the warrant that the 


47 The Court of Review noted, “We certainly understand the 1995 Justice Department’ s 
effort to avoid difficulty with the FISA court, or other courts; and we have no basis to 
criticize any organization of the Justice Department that an Attorney General desires.” Id. at 
727 n. 14. 


44 


FBI’s Minneapolis Field Office sought in the Moussaoui investigation, which 
we discuss in detail in Chapter Four. 


A. Legal requirements for a FISA warrant 


As noted above, FISA allows the FBI to conduct electronic surveillance 
and physical searches in connection with counterespionage and 
counterterrorism investigations. Rather than showing that the subject of the 
surveillance or the physical search is potentially connected to a crime, the FBI 
must show that there is probable cause to believe that the subject of the 
surveillance or search is an “agent” of a “foreign power.” With respect to a 
warrant for a physical search, the FBI also must show that there is probable 
cause to believe that the property to be searched is owned, used, possessed by, 
or in transit to or from an “agent of a foreign power” or “a foreign power.” 

50 U.S.C. § 1824(a)(3). 


1. Agent of a foreign power 


“Foreign power” as defined in the FISA statute has several meanings, 
most of which pertain to the governance of a foreign nation, such as “a foreign 
government or any component thereof, whether or not recognized by the 
United States” and “an entity that is directed and controlled by a foreign 
government or governments.” 50 U.S.C. § 1801(a)(1) & (2). The definition 
most applicable in the Moussaoui investigation is “a group engaged in 
international terrorism or activities in preparation therefor.” 50 U.S.C. 

§ 1801(a)(4). With respect to terrorism, before September 11, 2001, foreign 
powers that were used in requests for FISA warrants to the FISA Court 
included foreign governments as well as terrorist organizations not controlled 
by any foreign government, such as al Qaeda and Hizbollah. 


Whether a terrorist organization qualified as a “foreign power” under the 
FISA statute depended upon the intelligence developed about the group and its 
activities, and whether the FISA Court was convinced that the government had 
proven that the entity existed and was engaged in international terrorist 
activities. In practice, once the FBI developed the necessary intelligence about 
the existence of a terrorist organization, a particular subject was used as a “test 
subject” for pleading to the FISA Court that the organization was a foreign 
power. Although not dispositive, FISA applications might reference the fact 
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that the State Department had designated an entity as a “foreign terrorist 
organization” (FTO).* 


An “agent” of a foreign power also has several definitions in the statute. 
An agent can be a person who has an official connection to a foreign power, 
such as an employee of a foreign government or an official member of a 
terrorist organization. With respect to terrorism, an agent can be anyone who 
engages in international terrorism (or in activities that are in preparation for 
international terrorism) “for or on behalf of a foreign power.” 50 U.S.C. 
§ 1801(b)(2)(C). 


Aside from stating that a person must be acting “for or on behalf of” a 
foreign power, the FISA statute does not further define when a person is an 
“agent.” The legislative history of FISA states that there must be “a nexus 
between the individual and the foreign power that suggests that the person is 
likely to do the bidding of the foreign power,” and that there must be a 
“knowing connection” between the individual and the foreign power. H.R. 
7308, 95" Congress, 2d Session, Report 95-1283, Pt. 1, p. 49, 44 
(June 8, 1978). The legislative history also states that more than evidence of 
“mere sympathy for, identity of interest with, or vocal support for the goals” of 
a terrorist organization is required to establish agency between the group and 
the potential subject. Id. at p. 42. The Attorney General’s FCI Guidelines in 
effect in 2001 stated in the definition section that determining whether an 
individual is acting “for or on behalf of a foreign power” is based on the extent 


48 ETOs are foreign entities that are designated as terrorist organizations by the 
Secretary of State in accordance with the Antiterrorism and Effective Death Penalty Act, 
signed into law in April 1996. The criteria for this designation include: that the entity is a 
foreign organization, that the organization is engaged in terrorist activity, and that the 
organization’s terrorist activity must threaten the security of U.S. nationals or the national 
security of the United States. FTO designations expire automatically after two years but 
may be redesignated. It is unlawful for anyone to assist an FTO, representatives and 
members of FTOs are not admissible into the United States, and U.S. financial institutions 
that become aware of possession of funds of an FTO must report this information to the 
government. The first 30 FTO designations were made in October 1997. As of March 
2004, 37 FTOs were on the State Department list, including al Qaeda, Ansar al-Islam, and 
the Revolutionary Armed Forces of Columbia. 
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to which the foreign power is involved in controlling, leading, financially 
supporting, assigning or disciplining the individual. 


2. The application filed with the FISA Court 


To obtain an order from the FISA Court authorizing either electronic 
surveillance or a physical search, the FBI — through DOJ OIPR — submits to the 
FISA Court an application containing three documents. The first document, 
labeled “application,” is a court pleading that contains the government’s 
specific request for a FISA warrant and includes the required approval by the 
Attorney General or the Deputy Attorney General. See 50 U.S.C. § 1804(a) 
(electronic surveillance) and § 1823(a) (physical search). The second 
document is a certification by the FBI Director or other Executive Branch 
official that the information sought is foreign intelligence information and that 
the information cannot reasonably be obtained by normal investigative 
techniques. At the time of the Moussaoui investigation, as discussed above, 
the certification also had to contain a statement that the purpose of the search 
or surveillance was to obtain foreign intelligence information.” See 50 
U.S.C. § 1804(a)(7) (electronic surveillance) and § 1823(a)(7) (physical 
search). 


The third required document is an affidavit signed by an SSA from FBI 
Headquarters, which satisfies the FISA statute’s requirement that the 
application be made “by a Federal officer in writing upon oath or affirmation.” 
50 U.S.C. § 1804(a) (electronic surveillance) and § 1823(a) (physical search). 
The affidavit must contain “a statement of the facts and circumstances relied 
upon by the applicant to justify his belief” that the foreign power identified in 
the application is in fact a foreign power and that there are sufficient 
connections between the foreign power and the individual targeted to establish 
that the individual is acting as an agent of the foreign power. Id. With respect 
to a physical search, the affidavit also must show that the property to be 
searched contains foreign intelligence information, and the property to be 


* As previously discussed, the Patriot Act amended this section of the FISA statute to 
require that the certification state that “a significant purpose” of the surveillance or search is 
to obtain foreign intelligence information. 
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searched is owned, used, possessed by, or is in transit to or from a foreign 
power or an agent of a foreign power. 50 U.S.C. § 1823(a)(4).”° 


The FISA statute also provides that in order for a judge to issue an order 
approving the FISA application, the judge must find that “on the basis of the 
facts submitted by the applicant there is probable cause to believe that the 
target of the electronic surveillance is a foreign power or an agent of a foreign 
power.” 50 U.S.C. § 1805(3). 


B. Assembling an application for submission to the FISA Court 


Prior to September 11, 2001, the FISA application process involved 
several layers of review and approval at FBI Headquarters and at OIPR before 
presentation to the FISA Court. The process began when the field office 
submitted an EC or letterhead memorandum (LHM) to FBI Headquarters 
setting forth the supporting evidence for the FISA warrant.’ An SSA and IOS 
in FBI Headquarters worked with the field office in reviewing, editing, and 
finalizing the LHM. An NSLU attorney reviewed, edited, and approved the 
LHM, then obtained several ITOS management approvals before sending the 
request to OIPR for consideration. Using the information provided in the 
LHM, an OIPR attorney drafted the FISA application and other required 
documents, which were reviewed in draft by the OIPR attorney’s supervisor. 
The documentation drafted by OIPR was provided to the SSA, IOS, and NSLU 
attorney for their review before being finalized by the OIPR attorney and filed 
with the FISA Court. This process normally took several months to complete, 
although we were told a FISA warrant could be obtained in a matter of several 
hours or a few days if needed. 


We describe below in more detail each step in the process, with special 
attention to the role of each person involved in the process. 


°° OIPR also submits to the FISA Court a draft order or orders for the FISA judge’s 
completion and signature. 


51 An LHM is a memorandum on FBI letterhead stationery that is used to communicate 
to the Attorney General, other Department officials, or persons or agencies outside the FBI. 
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1. Investigation and LHM prepared by field office 


An application for a FISA warrant normally originated from the 
investigative work conducted by a field office. During the investigation, the 
field office typically developed information about the subject of the 
investigation by checking FBI indices and files, reviewing publicly available 
records, and inquiring with domestic and foreign law enforcement and 
intelligence agencies — such as the CIA and NSA — about the subject. In 
addition, the field office could conduct other investigative activities. The field 
office also could obtain the subject’s records of telephone calls, computer 
transactions, and financial information through National Security Letters 
(NSLs).** This phase of collecting information can last anywhere from several 
days to several months. 


If a field office wanted to obtain a FISA warrant and thought it had 
sufficient information to support a FISA warrant, the field office prepared an 
LHM setting forth as specifically as possible the supporting information. The 
LHM was sent to the appropriate unit at FBI Headquarters, where it was 
assigned to a particular SSA for handling. 


2. Role of SSAs and IOSs at FBI Headquarters 


At the time of the Moussaoui investigation in August 2001, once the 
LHM was received in FBI Headquarters by the appropriate SSA, that SSA was 
responsible for ensuring that the FISA request was adequately supported and 
complete before it was presented to OIPR. To do this, the SSA — working in 
conjunction with the assigned IOS — reviewed the documentation to assess 
whether it contained sufficient information for a FISA or whether there were 
questions that would have to be answered before the request could be 


°° NSLs are issued in intelligence investigations to obtain telephone and electronic 
communications records from telephone companies and internet service providers (pursuant 
to the Electronic Communications Privacy Act, or ECPA, 18 U.S.C. § 2709), records from 
financial institutions (pursuant to the Right to Financial Privacy Act, 12 U.S.C. 
§ 3414(a)(5)), and information from credit bureaus (pursuant to the Fair Credit Reporting 
Act, 15 U.S.C. §§ 1681u and 1681v). They do not require approval of a court before 
issuance by the FBI. Prior to September 11, the process for issuing NSLs could take several 
months. We discuss this issue in Chapter Four of the report. 
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completed. The SSA also assessed whether the appropriate foreign power was 
being pled and whether there was sufficient information connecting the subject 
to the foreign power. 


The SSA and the IOS communicated with the field office directly about 
any problems or for additional information. In problematic cases, the SSA 
would consult with an NSLU attorney for advice and suggestions. 


The SSA and the IOS used the documentation submitted by the field 
office and often edited the document. In some instances, the FISA request was 
completely rewritten, and in other instances few changes were made. 


With respect to the information supporting the existence of the foreign 
power, the SSA or IOS typically inserted language used in other FISA 
applications involving the same foreign power. If the SSA or IOS acquired 
additional information to support the application, such as information 
indicating connections between the subject and the foreign power, that 
information was also included in the LHM. 


At the time of the Moussaoui investigation, the SSA would normally 
review the edited version of the LHM with the field office to ensure the factual 
accuracy of the LHM.” Once the field office and the SSA agreed on the final 
version of the LHM, the SSA sought review and approval by an NSLU 
attorney and finally obtained the appropriate signatures within FBI 
Headquarters management, such as the signatures of the Unit and Section 
Chiefs. This editing process could last from several days to several months. 


53 Such consultations with the field office about edits arose primarily because of the 
problems the FBI had encountered with the FISA Court in the fall of 2000 and spring of 
2001 over inaccuracies in the affidavits signed by SSAs and filed with the FISA Court. In 
March 2001, the FBI adopted procedures requiring the SSA at FBI Headquarters handling a 
FISA request to review OIPR’s draft affidavit with the field office to ensure the factual 
accuracy of the affidavit before it was filed with the FISA Court. Because of these 
requirements and other concerns about the accuracy of the affidavits, SSAs spent more time 
than they had in the past discussing drafts of FISA documents with field offices. 
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3. Role of NSLU attorneys 


At the time of the Moussaoui investigation in August 2001, two attorneys 
in the National Security Law Unit (NSLU) of the FBI’s Office of the General 
Counsel were assigned full-time to counterterrorism matters.** No attorney 
was assigned responsibility for a particular FISA request from beginning to 
end. 


The two NSLU attorneys assigned to counterterrorism matters had two 
functions with respect to FISA requests submitted by field offices. First, they 
functioned in an advisory capacity. The SSA would consult with an NSLU 
attorney if a question or problem arose or if the SSA needed legal advice. 
NSLU attorneys also were consulted when there was a disagreement between 
the field office and FBI Headquarters about a particular issue, such as whether 
there was sufficient support for a FISA warrant. SSAs often discussed with 
NSLU attorneys whether the threshold of probable cause had been met for 
supporting that a subject was an agent of a foreign power. The former head of 
the NSLU told the OIG, however, that in “slam dunk” cases, FBI Headquarters 
would deal directly with OIPR without consulting an NSLU attorney. 


The second function of NSLU attorneys with respect to FISA requests 
was to review the LHM once it was finalized and to advise whether they 
believed OIPR would accept the LHM as having sufficient evidence to obtain a 
FISA warrant. If the NSLU attorney did not believe that the LHM contained 
sufficient evidence, the NSLU attorney would advise the SSA what additional 
information was needed and make suggestions about how the additional 
information could be acquired. Once the LHM was finalized and approved by 
the NSLU attorney, the signatures of the Unit Chief and the Section Chief were 
obtained, and the LHM was sent to OIPR. 


The NSLU attorney and the SSA also could make recommendations to 
the field office about how to acquire any additional information that was 
needed. If the field office provided additional information to support the FISA 
request, the LHM was revised and the FISA request was reviewed again. This 
process would continue until the NSLU attorney was satisfied that the 


54 Other NSLU attorneys primarily worked counterintelligence matters, although some 
of them assisted with counterterrorism matters when necessary. 
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standards for obtaining the FISA warrant were met. This step in the process 
also could last from several days to several months. 


4. Role of OIPR attorneys 


Once the SSA obtained the necessary FBI Headquarters approvals, the 
LHM and its supporting documents were provided to OIPR for preparation of 
the required pleadings. An OIPR attorney would review the LHM and 
determine whether there was sufficient evidence to obtain a FISA warrant. The 
OIPR attorney would consult with the FBI Headquarters SSA about any 
questions and would sometimes prepare a list of questions for the SSA to 
answer in writing. The SSA often consulted with the field office to obtain the 
information requested by the OIPR attorney and sometimes asked the field 
office to conduct additional investigation. This process also could take 
anywhere from several days to several months. 


Once the OIPR attorney was satisfied that there was sufficient evidence 
to support the FISA application, an OIPR attorney prepared the draft pleadings. 
A supervisory attorney in OIPR would review the draft pleadings and make 
recommendations and revisions. The final draft was provided to the SSA and 
the NSLU attorney for review. After finalizing the pleadings and obtaining the 
signatures of the FBI Headquarters SSA who signed the affidavit, the Attorney 
General, and the FBI Director, the OIPR attorney filed the pleadings with the 
FISA Court, along with a draft order for the judge’s signature. The FISA Court 
would then schedule a hearing, which was attended by the OIPR attorney and 
the SSA. 


If the FISA Court approved the warrant, it issued an order authorizing the 
surveillance or search. Orders authorizing surveillance were for a specific 
period, beginning and ending on a certain day and time. The order was 
transmitted to the field office responsible for conducting the surveillance or 
search. 


5. Expedited FISA warrants 


In the Moussaoui investigation, the Minneapolis Field Office requested 
an “emergency FISA,” which was a FISA that could be obtained in an 
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expedited manner.” The SSAs and NSLU attorneys we interviewed told us 
that what rose to the level of “expedited” depended on what the field office and 
ITOS management deemed to be an immediate priority. According to these 
witnesses, in the summer of 2001 expedited FISA requests normally involved 
reports of a suspected imminent attack or other imminent danger. 


Although the normal processing time for a FISA application was several 
weeks or months, FBI Headquarters working with an NSLU attorney and OIPR 
could prepare an expedited FISA application for presentation to the FISA 
Court in a matter of several hours or days, depending on the circumstances 
giving rise to the expedited request. 


°° Although expedited FISA requests were commonly referred to as “emergency 
FISAs,” the statute provided for an “emergency FISA” that was different from an expedited 
FISA. The statute stated that an emergency FISA allowed the Attorney General - without 
prior approval of the FISA Court - to authorize the execution of a search warrant or 
electronic surveillance if the Attorney General determined that “an emergency situation 
exists” and there was a “the factual basis for issuance of an order” in accordance with the 
statute. See 50 U.S.C. § 1805(e) (electronic surveillance) & § 1824(e) (physical search 
warrant). The government was required to present an application to the FISA Court with 
respect to any such warrantless search or electronic surveillance within 24 hours of the 
execution of the search or surveillance. 50 U.S.C. § 1805(e) (electronic surveillance) & 
§ 1824(e) (physical search warrant). This type of emergency FISA rarely was used before 
September 11, 2001. 
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CHAPTER THREE 
THE FBP?S HANDLING OF THE PHOENIX ELECTRONIC 
COMMUNICATION AND OTHER INFORMATION 
RELATING TO USE OF AIRPLANES IN TERRORISTS 
ATTACKS 


I. Introduction 


In this chapter of the report, we examine allegations that the FBI failed to 
act prior to September 11, 2001, on intelligence information that warned of 
potential terrorists training in aviation-related fields of study in the United 
States. The focus of these allegations concerned an Electronic Communication 
(EC) dated July 10, 2001, that was written by Kenneth Williams, a special 
agent in the FBI’s Phoenix Division. In his EC, Williams wrote that he 
believed that there was a coordinated effort by Usama Bin Laden to send 
students to the United States to attend civil aviation universities and colleges. 
He suggested that the purpose of these students would be to one day work in 
the civil aviation industry around the world to conduct terrorist activity against 
civil aviation targets. Williams wrote that he was providing the information in 
the EC for analysis and comments. Williams addressed the EC to several 
people in FBI Headquarters and in the FBI’s New York Division.”® 


After September 11, 2001, the FBI has acknowledged several problems 
in how the Phoenix EC was handled. The FBI stated that the information 
raised in the EC should have been analyzed by the FBI, but that such analysis 
did not occur before September 11. In addition, the FBI acknowledged that the 
Phoenix EC should have been disseminated to other intelligence agencies and 
to the FBI’s field offices for their consideration, but it was not disseminated 
before September 11.” 


°° A redacted copy of this document is attached in the Appendix. 


” Director Mueller’s written statement for his October 17, 2002, testimony before the 
Joint Intelligence Committee Inquiry (JICI) stated: “We have heard, and we acknowledge, 
the valid criticisms, many of which have been reiterated by this Committee. For example, 
the Phoenix memo should have been disseminated to all field offices and to our sister 
agencies.” Former ITOS Section Chief Michael Rolince testified before Congress that the 
(continued) 
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In this chapter we analyze the FBI’s handling of the Phoenix EC. We 
first provide background on how leads were communicated and assigned in the 
FBI before September 11, 2001. We then summarize the contents of the EC. 
Next, we describe in detail how the Phoenix EC was handled within the FBI 
before September 11. In the analysis section, we examine problems in how the 
Phoenix EC was handled, first focusing on the systemic problems that affected 
the way the FBI treated the EC and then on the performance of the individuals 
involved with the EC. Finally, at the end of the chapter we discuss several 
other pieces of information in the possession of the FBI before September 11 
that also noted connections of potential terrorists to flight schools or the use of 
airplanes. 


II. The Phoenix EC 


A. Background 


In this section, we first provide the key terminology and a description of 
FBI processes that are relevant to the handling of the Phoenix EC. 


1. Assigning leads in the FBI 


When an FBI field office needs assistance or information from another 
office or from FBI Headquarters, it “sets a lead” for the assistance. Leads are 
initially written out in ECs, hard copies of which are mailed to the appropriate 
offices. In addition, when the EC is “uploaded” to the FBI’s Automated Case 
Support (ACS) system, leads associated with the EC are “set” electronically in 
ACS system. We describe both processes below. 


a. The manual process 


The specific action requested in an EC is stated in the lead section, which 
is at the end of the document. In the “To:” section of the EC, the author 
specifies the offices to which the EC is addressed. In the “Attention:” section, 


(continued) 
Phoenix EC should have been provided to the personnel assigned to FBI Headquarters from 
other agencies, such as the INS, the CIA, the FAA, and others, for their assessment. 
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the author specifies the persons who the author believes should receive a copy 
of the EC. 


ECs have a line marked “Precedence.” There are three options on the 
precedence line: “Immediate,” “Priority,” and “Routine.” The FBI’s 
investigative manual states that “immediate” precedence should be used “when 
the addressee(s) must take prompt action or have an urgent need for the 
information.” The manual states that “priority” precedence should be used 
when information is needed within 24 hours, and “routine” precedence should 
be used when information is needed within the normal course of business. The 
time frame for responding to “routine” requests is not specified. 


The office preparing an EC that sets a lead normally sends a hard copy of 
the EC to the offices with leads mentioned in the EC. The paper EC is 
normally sent through “Bureau mail,” which is the FBI’s interoffice mail 
delivery system. 


The distribution of the hard copy EC in the receiving office varies from 
office to office. In most offices, the EC is routed to an administrative 
employee assigned to the substantive program that is the subject of the EC, 
such as the squad secretary for the counterterrorism squad if counterterrorism 
is discussed in the EC. The administrative employee decides who should 
receive the hard copy EC, whether copies will be made, and for whom. All 
individuals listed on the attention line of a hardcopy EC do not necessarily 
receive a copy of the EC through the manual distribution process. 


b. The electronic process 


Leads contained in ECs also are set electronically in ACS when the EC is 
completed and is “uploaded” to ACS. The office requesting the lead can enter 
in ACS a deadline for handling the lead. If no deadline is set, the default 
deadline in ACS for action is 60 days. 


ACS contains an “electronic routing table” for each office that receives 
leads electronically through ACS. FBI offices set up the electronic routing 
table to assign leads to a particular person’s “lead bucket” based on the case 
number provided in the “Case ID #” field of the EC. For example, a field 
office may program its electronic routing table to direct all leads associated 
with cases having international terrorism identifiers to the secretary for the 
international terrorism squad. The secretary would then be responsible for 
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checking the “lead bucket” and determining to whom to assign the lead 
electronically. 


FBI employees are responsible for checking ACS periodically and 
accessing their lead bucket to see if any leads have been assigned to them. 
ACS does not notify users when leads are assigned to them. Only persons who 
are assigned a lead will see a notification of an EC associated with the lead 
when they check their lead buckets. All other persons listed on the attention 
line of the EC must search ACS for their names by conducting text searches 
and other kinds of searches to determine if there are any ECs containing their 
names. 


In ACS, leads may be “reassigned” or may be “closed.” When leads are 
closed, the person closing the lead fills in the field labeled “disposition” to 
indicate what action was taken with respect to the lead. However, ACS does 
not require this field to be completed in order to close the lead. 


c. Persons responsible for assigning leads 


At FBI Headquarters, the Radical Fundamentalist Unit (RFU) and the 
Usama Bin Laden Unit (UBLU) were the two units in the International 
Terrorism Operations Section (ITOS) involved in the handling of the Phoenix 
EC. Within the RFU and UBLU, Intelligence Assistants, called IAs, were 
responsible for many duties, including distributing hard copy ECs to the 
appropriate persons in the units, assigning leads in ACS, conducting name 
checks in ACS, and preparing ECs. In addition, before September 11, 2001, an 
IA assigned to an administrative unit in ITOS was responsible as a collateral 
duty for assigning leads that had been routed to ITOS’ general lead bucket in 
ACS. During the time period relevant to our investigation, this IA could assign 
leads from ACS directly to analysts in the section, called Intelligence 
Operations Specialists (IOSs). The IA also could route ECs directly to IOSs 
without any supervisor’s input or knowledge. 


IAs within the RFU and the UBLU normally determined to whom to 
assign a lead based on the case identifier, which is one of the required fields on 
an EC. For example, 199M matters, called “IT-Other,” were investigations 
related to terrorist groups that were not associated with one of the FBI’s 17 
other specific case identifiers. 199M or IT-Other matters normally were 
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assigned to the RFU. The case identifier associated with the Phoenix EC was 
199M, which fell under the RFU. 


Within a particular unit, the specific case number would also be used to 
determine whether an IOS or Supervisory Special Agent (SSA) was working 
on the designated case and therefore would be responsible for the lead. 


d. “Read and clear” 


A common type of lead is a “read and clear” lead. According to FBI 
procedures, “read and clear” leads are for informational purposes and do not 
require any action, other than “clearing” the lead in ACS by closing the lead. 
Witnesses told the OIG that setting a “read and clear” lead is similar to sending 
a “cc:” copy of a document to someone to read for their information. 


e. Persons responsible for conducting analysis in the FBI 


As discussed in Chapter Two, analysis of counterterrorism information 
normally was conducted in two places in the FBI. Operational or case-related 
analysis was performed primarily by IOSs who worked in ITOS, located in the 
Counterterrorism Division. Broader, strategic analysis was performed by 
Intelligence Research Specialists (IRSs) who at the time worked in the FBI’s 
Investigative Services Division (ISD), a separate division from the 
Counterterrorism Division.” 


As discussed in more detail below, the Phoenix EC was addressed to 
several SSAs and IOSs in ITOS. It was not addressed to any IRSs or anyone in 
the Investigative Services Division. 


58 ISD was created in November 1999 and housed the FBI’s analytical resources, such 
as the IRSs who handled counterintelligence matters, organized crime and white-collar 
crime matters, and domestic and international terrorism matters. In addition, ISD included 
an Intelligence and Operations Support Section that was responsible for administering the 
field’s analytical program and training and automation requirements. ISD was eliminated in 
the beginning of 2002. 
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B. The Phoenix EC 


Kenneth Williams, the special agent who wrote the Phoenix EC, joined 
the FBI in 1990, and was assigned to the Phoenix Division. He worked his 
first year and a half on white-collar matters. Since then, he was assigned to 
work on international terrorism matters. Williams told the OIG that while 
working on international terrorism matters, he spent almost all of his time on a 
terrorist organization that was not connected to Al Qaeda or Bin Laden. At 
FBI Headquarters, responsibility for this terrorist organization fell under the 
jurisdiction of a unit in ITOS other than the Usama Bin Laden Unit (UBLU). 
Williams said that he had not had any contact with the UBL unit. At the time 
of the EC, Williams reported to an SSA who we call “Bob,” who was 
responsible for the Phoenix counterterrorism squad. 


The Phoenix EC was dated July 10, 2001, and was addressed to the 
Counterterrorism Division at FBI Headquarters and to the New York Division. 
The precedence line on the EC was marked “routine.” 


Williams wrote in the opening paragraph of the EC that its purpose was 
to advise FBI Headquarters and the New York Division of his belief that there 
was the possibility of a coordinated effort by Bin Laden to send students to the 
United States to attend civil aviation universities and colleges. The EC stated 
that there was an inordinate number of individuals of investigative interest who 
were attending or had attended civil aviation universities and colleges in 
Arizona. Williams also wrote that there was reason to believe that a 
coordinated effort was under way to establish a cadre of individuals who one 
day would be working in civil aviation around the world, and these individuals 
would be in a position in the future to conduct terror activity against civil 
aviation targets. 


1. Information on individuals 


As the basis for his concerns, Williams summarized in the EC the results 
of four Phoenix intelligence investigations of four subjects who we will call 
“Subject No. 1,” “Subject No. 2,” “Subject No. 3,” and “Subject No. 4.” The 


°° Williams was responsible for the Subject No. 1 investigation, which was summarized 
in the EC. The other three investigations were international terrorism intelligence cases 
(continued) 
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other persons of investigative interest were described as seven “associates” of 
Subject No. 1. The Phoenix Division had opened a “preliminary inquiry” for 
an intelligence investigation about each of these persons but had not yet 
developed sufficient information to open a full investigation. 


Williams identified the connections of these individuals to aviation as 
follows: (1) Subject No. 1 was an aeronautical engineering student at Embry- 
Riddle Aeronautical University (ERAU) in Prescott, Arizona;® (2) Subject No. 
2 took classes at Cochise College, located in Douglas, Arizona, in the late 
1990s to obtain an FAA certificate in airframe and power plant operations;°" 
and (3) Subject No. 3 and Subject No. 4 were known to associate with a person 
we will call Subject No. 5, whose telephone number was associated with a 
known supporter of an African Muslim terrorist organization and who 
reportedly left the United States in the late 1990s after graduating from 
Westwind Aviation in Phoenix, Arizona.” 


(continued) 

handled by other agents on Williams’ squad and another squad in the Phoenix Division. 
Subject No. 2 also had been the subject of a separate investigation in an FBI field office in 
the western part of the United States before he moved to Arizona in the late 1990s. This 
field office’s investigation of Subject No. 2 was closed at the time the Phoenix EC was 
written. 


°° Williams stated in the EC that Subject No. 1 was enrolled in aeronautical engineering. 
ERAU offers a degree in aerospace engineering with a concentration in aeronautical 
engineering. Aeronautical engineering is the study of aircraft design. 


61 A certificate in airframe and power plant operations allows an individual to become 
an aviation maintenance mechanic. The courses for this certificate deal largely with 
maintaining aircraft in airworthy condition. 


6 The Phoenix EC does not state what courses Subject No. 5 took at Westwind 
Aviation. The Phoenix EC also does not state whether the FBI had an investigation open on 
Subject No. 5 at the time; however, according to Williams, the FBI did not have any 
investigation open on Subject No. 5 at the time because he was not in the United States. 
Subject No. 5’s name had surfaced in another FBI investigation involving the same African 
Muslim terrorist organization that Subject No. 5 was believed to be connected to. After 
September 11, Subject No. 5 was arrested on terrorism charges related to the September 11 
attacks, but he was released when a court found that the prosecutors lacked any evidence 
connecting Subject No. 5 to the events of September 11. 
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With respect to the seven associates of Subject No. 1, Williams wrote 
that three were enrolled in pilot training at ERAU, and three were enrolled in 
an aeronautical engineering program at ERAU. For the seventh, Williams had 
no record of classes taken.’ 


Williams also reported in the EC the connections of Subject No. 1, 
Subject No. 2, Subject No. 3, and Subject No. 4 to Bin Laden and to each 
other, which we describe below. 


Subject No. 1: The Subject No. 1 investigation was designated by 
Williams as a 199M or “IT-Other” matter.“ Williams told the OIG that he had 
opened the Subject No. 1 case under this designation after obtaining material in 
Subject No. 1’s garbage relating to Ibn Khattab, who Williams believed had a 
connection to Bin Laden. As discussed in more detail in Chapter Four, Ibn 
Khattab was a Jordanian-born, Islamic extremist who was the leader of a large 
group of Chechen rebels that had many successes in clashes with Russian 
forces.” 


In summarizing his investigation of Subject No. 1, Williams wrote in the 
EC that Subject No. 1 came to the United States in the late 1990s, and that in 
April 2000 one of Williams’ sources reported that Subject No. 1 was a 
supporter of Bin Laden. In addition, the EC stated that the source told 
Williams that Subject No. 1 was involved in the Al-Muhjiroun,®® a Muslim 
fundamentalist organization that Williams described as “dedicated to the 
overthrow of Western society” and as “an ardent supporter of [Bin Laden].” As 
further support for a connection between these persons and civil aviation, 


63 We asked Williams to confirm the courses these individuals took. After reviewing 
their files, Williams told the OIG that only two of the individuals were enrolled in pilot 
training and the other four were enrolled in aeronautical engineering. 


64 An EC requires a case number field to be completed. Williams used the Subject No. 1 
case number in the case number field of the Phoenix EC. 


°° Chechnya is a republic of the former Soviet Union. Since the collapse of the Soviet 
Union in 1991, Chechen separatists — both Islamic and non-Islamic — have sought 
independence from Russia. 


°° We observed several spellings for this organization in FBI documents, including Al- 
Muhajiroun and Al-Mouhajiroun. 
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Williams noted that the spiritual leader of the Al-Muhjiroun had issued a 
religious degree (or “fatwa”) in February 1998 in which he declared a “jihad” 
or “holy war” against the United States and British government, armies, 
interests, and airports.” (Emphasis in original.) 


Williams wrote in the EC that he had interviewed Subject No. 1 in the 
spring of 2000 and that during these interviews, which were conducted in 
Subject No. 1’s apartment, Williams observed photographs on the walls of Bin 
Laden, Ibn Khattab, and wounded Muslim separatists from Chechnya. 
Williams wrote that Subject No. 1 admitted during these interviews to being 
involved in the Al-Muhjiroun, and that he considered the U.S. government and 
military forces to be “legitimate military targets of Islam.” Williams noted in 
the EC that his investigation of Subject No. 1 was continuing. 


Subject No. 2: Williams reported in the EC that Subject No. 2 was 
known to have contact with Bin Laden lieutenant Abu Zubaida. Williams 
wrote that Subject No. 2 had moved to Arizona in 1998, but had left the United 
States in October 1999.” 


Williams also wrote that two persons arrested in June 2001 in Bahrain 
had admitted to being members of al Qaeda and had been planning an 
operation to bomb the U.S. embassy and military forces in Saudi Arabia. At 
the time of their arrest, they had in their possession a passport of a man who 
was believed to be a relative of Subject No. 2. Williams wrote that the man 
who was believed to be a relative of Subject No. 2 previously had entered the 
United States in 1998 with this passport and was associated with an address 
known to be that of Subject No. 2. Williams wrote that he had not been able to 
establish a connection between Subject No. 1 and Subject No. 2. 


Subject No. 3 and Subject No. 4: Williams reported in the EC that 
investigations of Subject No. 3 and Subject No. 4 had been opened based on 


67 The FBI field office that had been investigating Subject No. 2 had closed its 
investigation of Subject No. 2 at the time the Phoenix EC was written. 


68 Williams wrote in the EC that Subject No. 1 arrived in the United States in August 
1999 and that Subject No. 2 left the United States in October 1999. Williams also wrote that 
“Subject No. 2 had departed the U.S. prior to Subject No. 1’s arrival.” Williams told the 
OIG that this last statement was in error. 
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information from foreign governments demonstrating that they were both 
involved with African Islamic extremist/terror activity and had associated with 
individuals who had associated with Ahmed Ressam. Ressam was arrested on 
December 14, 1999, attempting to cross the border from Canada into the 
United States with chemicals and detonator materials in his car.” 


Williams wrote that Subject No, 3 and Subject No. 4 were friends with 
Subject No. 5, whose telephone number had been associated with a known 
supporter of an African Islamic terrorist organization. Williams noted that 
Subject No. 3, Subject No. 4, and Subject No. 5 had not been linked to Subject 
No. 1 or Subject No. 2. The EC did not state whether the FBI had an 
investigation open on Subject No. 5 or provide any further details on him. The 
EC reported that Subject No. 5 had left the country in November 1997 after 
graduating from Westwind Aviation. The EC did not describe the connections 
between the African Islamic terrorist organization and Bin Laden or al Qaeda. 


2. Recommendations in the Phoenix EC 


The Phoenix EC made four recommendations: 


e “(T]he FBI should accumulate a listing of civil aviation 
universities/colleges around the country”; 


e “FBI field offices with these types of schools in their area should 
establish appropriate liaison” with the schools; 


e “(FBI Headquarters] should discuss this matter with other elements of 
the U.S. intelligence community and task the community for any 
information that supports Phoenix’s suspicions”; and 


e “(FBI Headquarters] should consider seeking the necessary authority to 
obtain visa information from the [Department of State] on individuals 
obtaining visas to attend these types of schools and notify the 
appropriate FBI field office when these individuals are scheduled to 
arrive in their area of responsibility.” 


69 The Phoenix EC did not state Ressam’s affiliation with Bin Laden or al Qaeda. 
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In the lead section of the EC, Williams wrote that he was requesting that 
FBI Headquarters consider implementing the suggested actions. The New 
York Division lead was designated as a “read and clear” lead. At the end of 
the EC, Williams wrote that the information was “being provided to receiving 
offices for information, analysis and comments.” 


3. Addressees on the Phoenix EC 


The attention line of the EC contained the names the unit chief of the 
RFU, who we call “Don”; an IOS in the RFU who we call “Ellen”; the acting 
unit chief of the UBLU, who we call “Rob”; and UBLU IOSs who we call 
“Jane,” “Matthew,” and “Frank.” The RFU and the UBLU were the two 
units with program responsibility for the two primary organizations discussed 
in the EC: Al-Muhjiroun and Bin Laden/al Qaeda. 


The attention line also contained the names of two Special Agents who 
worked on two different international terrorism squads in the New York 
Division: an agent who worked on the New York FBI’s Bin Laden squad who 
we call “Jay”, and an agent who we call “Mark” and who worked on a New 
York squad that handled investigations that fell under the RFU. 


Williams told the OIG that his prior experience did not involve Bin 
Laden or Al Qaeda and instead centered on another terrorist organization 
which was managed by a unit other than the Bin Laden Unit at FBI 
Headquarters. He said that he was therefore not familiar with the personnel in 
the other units within ITOS, except for one long-time RFU IOS, who we call 
Frank. Williams said that he called Frank to obtain the names of the persons 
working in the RFU and the UBLU, and that he put in the attention line of the 
EC the names he had obtained by calling Frank. 


Frank told the OIG that he recalled talking to Williams about the EC and 
recommending several potential points of contact. Frank said that based on his 
understanding of what Williams was writing about, several people needed to 


7 Williams mistakenly identified the IOSs as IRSs in the Phoenix EC. In addition, at 
that time Matthew and Frank worked in the RFU, not the UBLU. At the request of the FBI, 
we have omitted the true names of most of the agents and the analysts who are discussed in 
this report. 
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see the EC because more than one program was involved. He said that because 
the New York Field Office was the primary field office that handled the FBI’s 
Bin Laden-related investigations, he likely recommended that Williams also 
address the EC to a point of contact in New York. 


When asked why he did not recommend including any IRSs on the 
attention line, Frank told the OIG that the Investigative Services Division was 
“on its last legs” at the time and that there were very few IRSs in the ISD still 
working on analysis. He explained that any work of the IRSs would have to be 
coordinated through an IOS, so it made sense to route the EC through an IOS 
in the first instance. 


Williams also told the OIG that at the time he was familiar by name with 
Ellen because, prior to writing the Phoenix EC, he had accessed in ACS an EC 
she had written on the Al-Muhjiroun in 1999. Ellen told the OIG that Williams 
called her on July 9, 2001, to tell her that he had used her paper in writing his 
EC and that he had included her name on the attention line. She said that he 
also asked her if she recommended anyone to include on the attention line and 
that she gave him the name of Mark, one of the New York Division agents who 
had been the case agent for the FBI’s investigation of the Al-Muhjiroun. 


C. Williams’ theory 


Williams told the OIG that in the EC he was putting forth “an 
investigative theory” or “hunch” about Bin Laden sending students to attend 
civil aviation schools ultimately to conduct terror activity against civil aviation 
targets, and he was seeking an analytical product or feedback in response to his 
theory. He said that he was basing the theory on his almost ten years of 
experience in international terrorism cases and his knowledge that al Qaeda 
had a presence in Arizona. He said that he had learned in squad meetings 
about Subject No. 2, and he thought it was “unusual” that Subject No. 2 would 
come across the world to study aircraft maintenance in the United States. 
Williams said that at the time, he also was working the investigation of Subject 
No. 1 and he began thinking that he should look to see how many other 
investigations were being handled in Arizona that involved individuals with 
Islamic militant viewpoints who also were enrolled in civil aviation colleges or 
universities. He said that after he did and learned about several others of 
interest to the FBI, he decided to put his thoughts and recommendations on 


Paper. 
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Williams explained that he was not focused on flight schools, but instead 
focused on colleges and universities where individuals could earn degrees in 
aviation-related subjects and then obtain jobs in the civil aviation industry in 
this country. He also said that he was not contemplating in the EC that there 
was a plot to use airplanes as missiles. Rather, he believed that there could be 
an effort under way to develop expertise about where to put an explosive 
device on an airplane or how to mechanically alter an airplane in order to cause 
it to crash. Williams told the OIG that he did not have information of a 
specific threat or pending attack, which is why he marked the EC’s precedence 
as “routine.” 


Williams told the OIG that he did not know at the time whether Subject 
Nos. 3 and 4 discussed in the EC or the African Islamic terrorist organizations 
were connected to Bin Laden or al Qaeda. Williams said that he was trying to 
“paint a picture of people associated with radical Islam” who were also 
associated with aviation. Williams said he wanted FBI Headquarters to look at 
his EC and answer the question: “Is there something to this, that all of these 
people were involved in aviation?” He stated that he did not expect an 
immediate response and believed that it would take at least a couple of months 
for FBI Headquarters to review the EC, because he knew that resources for this 
kind of analytical project at FBI Headquarters were limited. In addition, he 
said that he wanted FBI Headquarters to share his theory with other elements 
of the Intelligence Community to see if anybody else had any information to 
corroborate his theory.” 


71 In the summer of 2003, the OIG received new allegations from a former FBI 
confidential informant whose control agent had been Williams. The former informant 
alleged that he had informed Williams in October 1996 that he was concerned that a terrorist 
could use crop duster airplanes as weapons and that one of the subjects of the Phoenix EC 
and other Middle Easterners were attending flight schools in Arizona. The former informant 
also said that he believed Williams had written the Phoenix EC because in May 2001 the 
informant had raised complaints with the Phoenix FBI about how it handled him as an 
informant and why he was closed as an informant in 1999. The former informant also 
alleged that a reporter had called Williams in June or July 2001 about the former informant’s 
information concerning Middle Eastern matters. 


We reviewed the former informant’s allegations and did not find evidence to support 
them. There is no mention in a May 2001 memorandum that describes the FBI interview of 
(continued) 
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Williams stated that he also knew that there were some “inherent legal 
issues” with the recommendations in the EC because he believed that concerns 
about racial profiling would have to be addressed. Moreover, he said that he 
was not aware at the time whether the FBI had the authority to review the visa 
information of thousands of people applying to civil aviation universities and 
colleges in the United States, as he had recommended in the EC. 


After the Phoenix EC was completed and sent, Williams did not contact 
anyone at FBI Headquarters or in New York to discuss its contents or check the 
status of the leads in ACS. 


D. FBI Headquarters’ handling of the Phoenix EC 


Although the EC is dated July 10, the Phoenix Division did not upload 
the EC into ACS until the afternoon of Friday, July 27, 2001. The Phoenix 
FBI also mailed the paper copy to FBI Headquarters around July 27. 


ACS records show that, because of the case designation listed on the 
Phoenix EC, the lead for FBI Headquarters was initially routed electronically 
through the ITOS electronic routing table to a general ITOS lead bucket that 
was handled by an ITOS administrative unit. The lead was not directly routed 
to the RFU or the UBLU.” An IA in the administrative unit in ITOS was 
responsible for checking the ITOS general lead bucket regularly and 
electronically assigning these kinds of leads to the appropriate person within 
ITOS. 


(continued) 

the former informant that the former informant claimed he had provided information to 
Williams about terrorists using planes as weapons or Middle Easterners in flight schools. 
Williams also told us that the former informant never discussed any concerns about terrorists 
using airplanes as weapons or concerns about Middle Eastemers in flight schools. The 
former informant’s informant file contained no information about reports regarding Middle 
Easterners and flight schools. In addition, Williams said that he never spoke to the reporter 
who the former informant said had called Williams, and that he was not prompted to write 
the Phoenix EC because of a phone call from any such reporter. 


” At the time, the electronic routing table in ACS for the Counterterrorism Division 
was set up to automatically route leads associated with cases with the type of case number 
designated on the Phoenix EC to an administrative unit in ITOS rather than to a particular 
operational unit. 
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1. Assignment to the RFU 


On the morning of Monday, July 30, 2001, the ITOS IA accessed in ACS 
the text of the Phoenix EC. ACS shows that on that same day the ITOS IA 
assigned the lead in ACS to Ellen, an IOS in the RFU who was listed second 
on the attention line of the EC. 


The ITOS IA told the OIG that he did not recall the Phoenix EC or 
assigning the lead, but that his practice was to review the text of the lead and 
the person or persons listed on the attention line to determine to whom to 
assign the lead. The EC indicated that it related to an “IT-Other” matter and 
these cases fell under the RFU. The ITOS IA said that he sometimes consulted 
with his unit chief if he was unsure to whom to assign the lead, but he said he 
did not recall whether he did so in this case. 


Ellen told the OIG that she pulled the Phoenix EC up in ACS, printed a 
copy, and read it.” She said that, after reading it, she thought that the EC 
should be reviewed by the UBLU, not by her unit, because the EC discussed 
Bin Laden and al Qaeda, which were the responsibility of the UBLU. 


Ellen therefore discussed the EC with one of the IOSs who worked in the 
UBLU, who we call Jane. Ellen said she recalled asking Jane if she should 
transfer the lead to Jane, and that Jane stated that she did not have time to look 
at it then. Ellen said that Jane asked if she could get back to Ellen in a week. 


Ellen said that she therefore consulted with Jane about a week later. ACS 
records show that Jane downloaded the Phoenix EC from ACS on August 7, 
2001. According to Ellen, she and Jane discussed the tremendous effort that 
they thought would be needed to implement the recommendations in the EC. 
Ellen said that they also discussed whether they would be able to implement 
the recommendations because they believed that the FBI’s attorneys in the 
NSLU would consider it racial profiling to send leads to the field to collect 
information about Middle Eastern men who happened to be attending schools 
related to civil aviation. 


Ellen said that Jane agreed that Jane should handle the Phoenix EC. 
Ellen told the OIG that she remembered Jane saying she wanted to do more 


73 Ellen told the OIG that she never received a hard copy of the Phoenix EC. 
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research on FBI investigations to determine what other connections might exist 
between Bin Laden, al Qaeda, and aviation, and then, depending upon the 
results of that research, perhaps disseminate it. Ellen said that Jane also told 
her that she also wanted to speak with her supervisor and decide what action to 
take on the Phoenix EC. 


Ellen said that, after talking with Jane, she closed the lead in ACS on 
August 7, 2001, indicating in ACS that Jane was planning to conduct additional 
research before proceeding. ACS shows that Ellen wrote in the “disposition” 
field for the lead that the lead was “covered-consulted with UBLU, no action at 
this time, will reconvene on this issue.” Ellen said that after she and Jane 
discussed the issue, they agreed to “revisit” the issue later once Jane had done 
some research and had a better idea of how to proceed. Ellen also said that she 
closed the lead rather than asking an JA to reassign the lead to Jane because she 
knew that it would take some time for the necessary research to be done, and 
that the RFU unit chief — Don- had instructed RFU employees that leads had to 
be closed in a timely manner. 


Ellen told the OIG that she thought that the theory presented in the EC 
was “interesting,” but that she, like Jane, believed that further research needed 
to be conducted before any action was taken on the Phoenix EC. Ellen also 
asserted, “It was a theory that certainly needed to be explored more fully before 
disseminating it to the [Intelligence Community] as fact or not.” In addition, 
Ellen said that she believed that attorneys in the FBI’s National Security Law 
Unit (NSLU) would have had to review the Phoenix EC before any action 
could be taken on it because the issue of racial profiling was “hot.” 


When we asked Ellen whether she considered referring the Phoenix EC 
to the ISD to research and analyze, she stated that the RFU did not have an ISD 
analyst assigned to it at the time. Ellen acknowledged that it would have been 
possible for the ISD to assign an IRS analyst to do strategic research regarding 
the EC, but she believed the EC should first be referred to the UBLU, since the 
EC’s focus was al Qaeda and it was the UBLU’s prerogative to decide how to 
proceed on it. 


Ellen told the OIG that she did not recall consulting with her supervisor 
in the RFU, an SSA who we call “Chris,” about how to handle the Phoenix EC, 
or showing it to him. She said that she might have mentioned it in passing to 
Chris, but it was common for IOSs to close leads without supervisory input. 
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Chris was an SSA assigned to the RFU from the summer of 2000 until 
September 10, 2001, when he left FBI Headquarters. Chris told the OIG that 
he never saw or discussed the Phoenix EC with anyone prior to September 11. 


Don was the unit chief of the RFU at this time. He joined the FBI in 
1987 and was assigned to the RFU in May 2001. Don said that he first learned 
of the Phoenix EC only after the September 11 attacks. He indicated that 
neither Ellen nor anyone else mentioned the EC to him before September 11. 
He said that on average he reviewed 30 to 45 ECs a day that were assigned to 
the RFU, and because of the vast amount of intelligence data that had to be 
analyzed by the seven IOSs in the RFU, the RFU had to rely on their judgment 
to accurately prioritize the information. Don stated that if he had seen the 
Phoenix EC before September 11, he would have discussed its 
recommendations with his UBL counterpart, then forwarded the EC to the 
ITOS Section Chief, Michael Rolince, for a decision on the course of action to 
take on the EC. 


2. Assignment to the UBLU 


a. Jane’s handling of the EC 


As noted above, Ellen reassigned the Phoenix EC to Jane, an IOS in the 
UBLU. In addition, the hard copy version of the EC, which Phoenix had 
mailed to FBI Headquarters, also was assigned to Jane. According to Jane, on 
or about July 30, an IA in the RFU delivered the hard copy of the Phoenix EC 
to Jane. Jane provided the OIG with the copy that she received from the IA, 
which Jane had initialed to indicate receipt. 


Jane told the OIG that she also recalled discussing the EC with Ellen. 
Jane said that after she read the EC, she told Ellen that she agreed that it made 
more sense for the UBLU, rather than RFU, to handle it because of the 
references to Bin Laden. 


Jane told the OIG that she did not believe that there was a sufficient 
“factual predicate” to justify taking any immediate action on the EC, such as 
disseminating it to the Intelligence Community. Jane asserted that based on 
what was in the EC she did not believe that Subject No. 1 had a strong 
connection to Bin Laden. She said that the investigation of Subject No. 1 was 
opened as an Islamic Army of the Caucuses/Ibn Khattab matter, and, according 


71 


to Jane, “Ibn Khattab has never taken operational directions from Usama Bin 
Laden.” She said that, according to the EC, the primary evidence of the 
connection was that Subject No. 1 was a member of Al-Muhjiroun and had a 
picture of Bin Laden on his wall. She stated that she confirmed with Ellen that 
while Al-Muhjiroun verbally supported Bin Laden, the FBI had not developed 
any evidence that Al-Muhjiroun had provided any operational support to Bin 
Laden.” 


In addition, Jane told the OIG that she recalled concluding that the 
factual predicate was weak because many of the individuals who were listed in 
the EC as associated with Subject No. 1 were the subjects of only preliminary 
inquiries, not full investigations. Jane said that based on what she saw in the 
EC and knew about Bin Laden, she did not see the connection between Bin 
Laden and Subject No. 1 or the other subjects of the EC. She stated that she 
did not feel “comfortable at this stage going forward with the theory that we 
think these individuals from these countries are coming here sent by UBL, 
when the preponderance of evidence indicates that these people are aligned 
with Al-Muhajiroun and Ibn Khattab.” She said that being associated with Ibn 
Khattab “did not equate” with being associated with Bin Laden. 


Jane said that the fact that the Phoenix EC reported that a large number of 
Middle Eastern men were training in U.S. aviation-related schools did not 
strike her as significant because it was well known that Middle Eastern men 
have historically trained in U.S. flight schools because they are cheaper and 
better than other flight schools around the world. She suggested that before 
September 11, even someone of investigative interest training in a U.S. school 
in an aviation-related field did not necessarily raise a red flag. 


Jane said that she told Ellen that she needed to do some research before 
she took any action on the EC. According to Jane, she initially thought of a 
handful of steps she wanted to take based on her knowledge of ongoing cases 
within the FBI. Jane said that she wrote a “to do” list on a yellow post-it note 
and attached it to her copy of the EC. She said she thought that there were at 


74 Mark, who had been the case agent in New York on the FBI’s investigation of the Al- 
Muhjiroun, told the OIG that the New York Division had closed its case on Al-Muhjiroun 
long before September 11 because the FBI was not able to establish that Al-Muhjiron had 
engaged in terrorist activities or supported terrorist activities. 
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least four items on the list, but she could not specifically remember all of 
them.” However, she said she recalled that one of the items on the list was to 
review the FBI’s information on Essam Al Ridi, a former personal pilot for Bin 
Laden who testified for the government in the trials against the persons 
responsible for bombing the U.S. embassies in East Africa in August 1998, to 
see if al Qaeda had undertaken any similar initiatives as those discussed in the 
Phoenix EC. 


Because the EC included information about Subject No. 2, who had 
previously lived and studied in the United States and had ties to suspected 
terrorists arrested a few weeks prior, Jane said that she immediately thought of 
an issue being researched by an IRS in an FBI field office. We call the IRS 
“Lynn.”’° Lynn had been involved with the field office’s intelligence 
investigation of Subject No. 2 when he lived in the area. As noted in the EC, 
two al-Qaeda operatives were arrested in Bahrain at the end of June 2001 who 
had been planning an operation to bomb the U.S. embassy and military forces 
in Saudi Arabia. At the time of their arrest, they were in possession of a 
passport containing the name of a person believed to be a relative of Subject 
No. 2. 


In June 2001, Jane had asked Lynn to review her field office’s case file 
on Subject No. 2 to try to find connections between Subject No. 2 and his 
associates in the state where the field office was located and the two al Qaeda 
operatives arrested in Bahrain. Jane told the OIG that she was familiar with 
this field office’s investigation of Subject No. 2 and several of his associates 
who were living in the area. She said that she knew that Subject No. 2 and his 
associates had attended civil aviation school in the United States and were 
employed by a Saudi airline company, although she did not believe that 


” In November 2001, Jane was interviewed about the EC by an OIG Special Agent who 
conducted a preliminary review regarding the Phoenix EC. Jane said that she gave the EC 
with the post-it note on it to the OIG Special Agent. The Special Agent confirmed that Jane 
gave him the EC along with the note, but he was not able to locate the post-it note when he 
retrieved the original EC several months later. 


’° Lynn had been an IRS with the FBI for approximately two years at the time of the 
Phoenix EC. She handled all counterterrorism-related analytical work for the FBI field 
office in which she was employed. 
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Subject No. 2 was a pilot. She said that she thought that Lynn might be aware 
of something in what she was researching about Subject No. 2’s contacts in the 
area of the field office that could support the theory in the Phoenix EC. 


As aresult of the arrest of the two al Qaeda operatives in Bahrain, Jane 
also was dealing with Williams’ supervisor who we call “Bob,” and with 
agents in the Phoenix Division other than Williams on Phoenix’s Subject No. 2 
investigation, which was closed at the time. She stated that the FBI Phoenix 
Division had been asked to follow up on matters in the Subject No. 2 
investigation that had been left unfinished, such as documents that had been 
collected from several sources but never read or analyzed. In addition, Jane 
stated that she had been in contact with the Phoenix Division about locating a 
source who previously had been married to a woman who was married to a 
family member of Subject No. 2. 


However, Jane told the OIG that she did not have any contact with 
Williams about the Phoenix EC and that her only contact with Bob about the 
EC was via e-mail. On August 6, 2001, Jane sent an e-mail to Bob asking if he 
had any objection to her sending the Phoenix EC to Lynn. Bob replied via e- 
mail the same day that he did not have any objection. 


The next day, Jane sent the Phoenix EC to Lynn. In an e-mail message 
attached to the EC, Jane stated: “I thought it would be interesting to you 
considering some of the stuff you were coming up with in [your field office]. 
Let me know if anything strikes you.” Jane told the OIG that she wanted to 
know if Lynn saw any similar patterns between the associates of Subject No. 2 
that she was researching in her area and the individuals discussed in the 
Phoenix EC. However, Jane did not assign a lead to Lynn, nor did she call 
Lynn about the Phoenix EC either before or after she e-mailed it to her. 


b. Lynn’s response 


Lynn told the OIG that she received the Phoenix EC and Jane’s e-mail, 
and she read them. Lynn stated that she believed that Jane sent her the EC 
because Jane was aware of her field office’s earlier investigation of Subject 
No. 2 and several of his associates. Lynn said that in these investigations, the 
FBI observed some trends, such as that all of the subjects were of Saudi 
descent, were employed by Saudi airlines, and were involved with aircraft 
maintenance or had pilots’ licenses, and that the Saudi airline company was 
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paying for their training. Lynn said that the investigation also had revealed that 
the subjects were calling various gun dealers and gun shops. She said that the 
FBI personnel involved in the investigation questioned whether the subjects 
were using Saudi airlines to transport weapons, but that nothing further had 
developed in the investigations to support this theory and that the field office 
investigation was closed. According to Lynn, by the time the name of Subject 
No. 2 resurfaced in June 2001 based on the arrest of the two al Qaeda 
operatives in Bahrain, he had not been in her area for approximately three 
years. 


Lynn said that, although she did not recall speaking with Jane about the 
EC, she believed that Jane was passing the EC to her for informational 
purposes. Lynn said that she was interested in whether there was any 
information in the EC that would inform the work that she was doing on 
Subject No. 2 at the time, but that after reading the EC, she concluded that it 
did not affect her investigation. She said she considered it good information to 
know and that it was a “piece of the puzzle.” She said that based on her work 
on the matter of Subject No. 2, she was not aware of any information 
supporting Williams’ theory that Middle Easterners were receiving aviation 
training for the purpose of conducting terrorist activity. She stated that it was 
“no big secret” that Arab nationals received aviation training in the United 
States. She said that for these reasons, she did not respond to Jane’s e-mail. 


c. UBLU 


Jane said that, in addition to sending the EC to Lynn, she talked to the 
SSA with whom she worked in the UBLU who we call Rob, and told him 
briefly about the EC. Jane told the OIG that she could not recall whether she 
provided a copy of the EC to him.” She said that she explained to Rob that she 
believed that she should do some research before deciding to act on the EC. 
According to Jane, Rob concurred with her course of action. 


77 Jane later informed the OIG that she handed the Phoenix EC to Rob, that he skimmed 
the synopsis, and that he listened to her summary of the document and proposed course of 
action. 
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Rob was Jane’s SSA and also the Acting Unit Chief of the UBLU at the 
time. Rob, an FBI agent since 1990, had been assigned to the UBLU since 
1999. He was the Acting Unit Chief of the UBLU from June 28, 2001, until 
September 10, 2001. He told the OIG that he routinely reviewed dozens of 
ECs on any given day, and he often relied on the judgment of Jane and other 
IOSs concerning intelligence decisions. 


Rob said that he remembered Jane coming to him in the second week of 
August 2001 and telling him briefly about the Phoenix EC. He said that he 
also recalled her saying that she believed some preliminary research needed to 
be done before proceeding. He said that he did not see a copy of the EC, but 
based on Jane’s description, concurred with her decision to conduct some 
initial research before taking any other steps. Rob said he did not discuss the 
Phoenix EC with anyone else. 


According to Jane, she intended to address the Phoenix EC as time 
permitted. However, she said that she believed it would take a significant 
amount of time to do the research necessary to determine an appropriate 
response to the EC. She said that she was not able to return to the EC between 
August 7 and September 11 because of her heavy workload at the time. In 
addition to the work generated by the al Qaeda operatives arrested in earlier in 
the summer in Bahrain, she said that other matters at the time were of a higher 
priority than the Phoenix EC, such as another would-be al Qaeda “bomber” 
who was arrested in a foreign country, analysis of information received from a 
number of sources on the brother of a key Bin Laden lieutenant, and several al 
Qaeda-related threats of imminent attack. She stated that the entire UBLU was 
flooded with leads and requests concerning Bin Laden and also was handling 
“dozens” of leads on a daily basis associated with the attack on the U.S.S. Cole 
that had occurred in Yemen in October 2000. 


When we asked Jane why she did not refer the Phoenix EC to the ISD for 
analysis, she said she did not recall ever thinking that she should refer the EC 
to the analytical unit within the ISD. Jane noted that at the time the Phoenix 
EC was sent to FBI Headquarters, no IRS was assigned to the UBLU from the 
ISD. The last IRS assigned to the UBLU had arrived in February 2001, but 
had transferred in early July 2001 to another unit. The ISD had not replaced 
her. 


76 


Jane, who had been an IRS for approximately six months before 
becoming an IOS, told the OIG that she had planned to conduct the necessary 
analysis with respect to the theory presented by Williams because she did not 
believe there was anyone in the ISD to do this kind of research and analysis. 
When asked if she could have made a request of the ISD for assistance despite 
no one being specifically assigned to UBL matters, Jane responded that in 
other instances where her unit had asked for research from the ISD, it was not 
able to provide the support requested because it lacked adequate personnel to 
do so. 


Jane said that she did not recall seeing the Phoenix EC again until after 
September 11. 


The two other individuals in the UBLU who were listed on the attention 
line of the EC — Frank and Matthew — told the OIG that they did not see the 
Phoenix EC before September 11. ACS records also show that they did not 
access the Phoenix EC before September 11. ACS records also show that no 
other FBI Headquarters employees accessed the Phoenix EC before 
September 11. 


E. The New York Division’s handling of the EC 


The Phoenix EC also was routed by hard copy and through ACS to the 
FBI’s New York Division. Williams told the OIG that he sent the EC to the 
New York Division because it was the focal point for Bin Laden matters in the 
FBI. At the time, the New York Division was working several criminal and 
intelligence cases related to Bin Laden’s terrorist activities. 


Williams told the OIG that, by sending the EC to the New York office, he 
was seeking the expertise and knowledge of the office, not simply informing it 
of his theory. Williams said that he was anticipating an analysis of his theory 
from those in the FBI with more expertise and experience with Bin Laden 
matters, including the New York Division. 


The “attention” field of the EC contained the names of two New York 
FBI agents, who we call Jay and Mark, and the lead was designated as “read 
and clear.” As discussed above, within the FBI read and clear leads are 
considered for informational purposes and do not require any specific action. 
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Based on the electronic routing table in ACS, in New York the lead was 
initially routed to the Assistant Special Agent in Charge (ASAC) for the New 
York FBI’s Counterterrorism Program. The ASAC’s secretary was responsible 
for assigning leads routed to the ASAC. On July 30, 2001, she assigned the 
lead to a New York international terrorism squad based on the case number. 


According to witnesses we interviewed in New York, the volume of read 
and clear leads received each day by the New York office was enormous.” 
Squad secretaries were usually responsible for assigning “read and clear” leads 
directed to their squads. Leads were assigned to specific agents based on the 
names listed in the “attention” section of the EC, the case number, or the 
content of the EC. The Phoenix EC lead, however, was never assigned in ACS 
to a particular agent. The secretary of the New York international terrorism 
squad that had been assigned the lead closed the lead in March 2002.” 


The New York office’s hard copy of the Phoenix EC was routed to the 
international terrorism squad that handled Bin Laden investigations, where it 
was provided to Jay, the first New York agent listed on the EC. Jay had been a 
special agent with the FBI since 1976 and had worked on international 
terrorism matters since 1984. Since 1996, he was assigned to the squad that 
handled Bin Laden-related investigations, working primarily criminal 
investigations.” 


Jay told the OIG that the Phoenix EC was routed to his mail folder by the 
squad secretary. He said he recalled reading it in August 2001. He said that he 
did not know Williams and never spoke to him either before or after Williams 
wrote the EC. Jay said he assumed that Williams listed his name on the EC 
because he was one of the agents who worked on the Bin Laden squad in New 
York. 


78 We were told that in 2003 the squad that handled Bin Laden matters received 
approximately 3,300 leads. 


79 We were told that “read and clear” leads often were not closed in ACS for several 
months due to the lack of clerical support. 


80 The Phoenix EC addressed Jay as the SSA of the squad. He was one of two “relief” 
supervisors who filled in for the SSA when he was not in the office. At the time, the SSA 
was out of the office on extended medical leave. 
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Jay told the OIG that he did not believe that Williams’ theory was based 
in fact. He asserted that a “glaring deficiency” was the implication that Bin 
Laden had a support network in Arizona. He asserted that there had been a 
terrorist cell that was active in Arizona, but that this was in the 1980s before al 
Qaeda existed. He said that based on what was written in the EC about Subject 
No. 1’s connections to Bin Laden — that Williams was basing the connection on 
what Subject No. 1 had said in two interviews — Jay believed that Subject No. 
1’s connection to Bin Laden was “tenuous, at best.” Jay stated that if it had 
been his responsibility to address the Phoenix EC, he would have “taken issue” 
with it and would have written back that he believed that the theory and 
conclusions were “faulty.” He added that the FBI was well aware that Bin 
Laden had individuals working for him with pilot training and that Middle 
Easterners commonly received flight training in the United States. He said he 
was not aware of anything that supported the theory espoused in the EC. 


Jay said that he reviewed the recommendations and saw that the 
requested actions in the EC were for FBI Headquarters to address. He said that 
he believes he may have discussed the EC with some of his colleagues and that 
they agreed that the recommendations were something for FBI Headquarters to 
address. Jay told the OIG that he did not contact Williams or anyone else in 
Phoenix to discuss the EC. 


Mark, the other agent listed on the attention line on the Phoenix EC, was 
assigned to the international terrorism squad that handled cases that were 
managed by the RFU. Mark told the OIG that he did not see the Phoenix EC 
until after September 11, 2001. ACS records confirm that he did not access the 
Phoenix EC until after September 11. 


Except for an analyst and an auditor in New York who reviewed the 
Phoenix EC in connection with searches unrelated to the Phoenix EC, and the 
secretary who accessed the EC to assign the lead, we found no evidence that 
anyone else in New York read the Phoenix EC or did anything with regard to 
it 


81 ACS shows that an auditor and an IRS ona squad not related to Bin Laden cases 
accessed the Phoenix EC during this time period. They both said the EC did not relate to 
what they were researching, and they did not do anything with it. 
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III. OIG analysis 


This section analyzes the handling of the Phoenix EC by the FBI. We 
believe, and the FBI has acknowledged, that the Phoenix EC did not receive 
the sufficient or timely analysis that it deserved, and it was not disseminated, as 
it should have been, for consideration and input by others in the FBI and the 
Intelligence Community. 


While the FBI analysts who reviewed the EC did not give it timely 
attention, we do not believe their individual failings were the main source of 
the problem with the handling of the EC. Rather, the deficiencies in its 
handling were caused in greater part by critical systemic failings in the way 
that intelligence information and requests for assistance were handled by the 
FBI prior to September 11. In this section, we discuss these systemic problems 
before evaluating the actions of the individual employees who came in contact 
with the EC. 


A. Systemic problems 


Before discussing the systemic failings evidenced by the handling of the 
Phoenix EC, it is important to note what the Phoenix EC was not. It was not an 
immediate warning about a terrorist plot, and it did not reveal information 
about the September 11 attacks or those who committed the attacks.” The EC 
itself was worded to convey that Williams was proposing a theory rather than a 
warning or a threat. Williams designated it as “routine” because he did not 
have any information of a specific threat or pending attack. He said that he 
was putting forth “an investigative theory” or “hunch,” and he was seeking an 
analytical product or feedback in response to his theory. He did not expect that 
to happen immediately. 


Yet, even though it did not contain an immediate warning and was 
marked routine, Williams’ information and theory warranted strategic analysis 
from the FBI, which it did not receive, and timely distribution, which it did not 


82 Tn prepared remarks for congressional testimony on May 8, 2002, former ITOS 
Section Chief Michael Rolince noted that “it should be stressed that none of the individuals 
identified by Phoenix were connected to the 9/11 attacks, nor did the leads stemming from 
that EC uncover the impending attacks.” (Emphasis in original.) 
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receive. While we cannot say that better handling of the Phoenix EC would 
have uncovered the September 11 plot, the EC should have been handled 
differently. 


1. Ineffective system for assigning and managing work 


The lead from the Phoenix EC was assigned by an administrative 
employee directly to an IOS in the RFU, Ellen, who discussed the matter with 
another IOS in the appropriate unit, Jane. They decided that Jane would handle 
the Phoenix EC. Thereafter, Ellen closed the lead in ACS and noted that she 
and Jane would discuss the matter further in the future. Although Jane briefly 
mentioned the Phoenix EC to her supervisor, the IOSs made independent 
judgments about what needed to be done to address the requests in the Phoenix 
EC and who to notify about it. Jane also decided when she would work on the 
Phoenix EC. We found that neither Ellen’s direct supervisor (Chris) nor Jane’s 
supervisor (Rob) ever received or reviewed the Phoenix EC. Nor did any other 
supervisor in FBI Headquarters. And as of September 11, Jane had not 
completed any work on the Phoenix EC. 


We found that the assignment of the lead from the Phoenix EC, the 
handling of the Phoenix EC independently by an IOS, and even the closing of 
the lead did not violate any FBI policies or practices at the time. In instances 
where IOSs received leads or intelligence information directly, they were not 
required to seek any supervisory input on the information that they were 
handling. Witnesses stated that more significant threat information or leads 
related to important cases usually were discussed with the SSAs, but that this 
did not occur with every lead or assignment, and it was not required. 


For example, Rob , the acting unit chief of the UBLU at the time, told the 
OIG that he often relied on the judgment of IOSs in how they handled their 
work. As a result, IOSs regularly handled most intelligence information and 
other assignments without supervisory input or knowledge. 


Much also was left to the IOS’s discretion in deciding what was a priority 
and which projects to focus on. Don, the unit chief of the RFU, said that at the 
time, managers relied on IOSs to exercise their judgment in how to prioritize 
their work. The IOSs we interviewed stated that the priorities were determined 
by the nature of the work. For example, they said they gave a threat of a 
terrorist attack or an emergency FISA request the highest priority. In addition, 


81 


if information was requested by higher level FBI officials or a Section Chief, 
that assignment was given priority. IOSs explained that, because of the crush 
of immediate projects, they were operating with a “triage” approach to their 
workload in which they dealt with crises or problems as they arose and 
thereafter dealt with routine matters. As with how they handled their leads and 
other assignments, we found that IOSs consulted with their supervisors about 
prioritizing their work only when they deemed it necessary. 


We believe that although the assigning of the lead and handling of the 
Phoenix EC was in accord with UBLU and RFU practices at the time, these 
practices were significantly flawed. Assigning work directly to IOSs with no 
requirement of supervisory input or review resulted in a lack of accountability 
for addressing leads and intelligence information. Without supervisory 
involvement, IOSs were permitted to determine what was a priority, and even 
when and whether work would be completed. As a result, there often was no 
check on the decisions being made by IOSs and no way to ensure that work or 
intelligence that was deemed of a lesser priority — such as the Phoenix EC — 
was ever addressed. This system was one in which important information 
could easily “fall through the cracks,” not receive timely attention, or not be 
brought to the attention of those inside and outside the FBI who had a reason 
and a need to know the information. 


The lack of accountability and supervisory involvement was compounded 
by the fact that the FBI’s computer system, ACS, was not set up to ensure that 
all addressees on an EC were even made aware of the EC. Only individuals 
assigned leads associated with the EC would be notified electronically of the 
document’s existence. This meant that when the EC and leads were uploaded, 
the EC would not be seen by a supervisor, even if the supervisor was an 
addressee on the attention line, unless the supervisor searched ACS for the 
document. Nor was there any assurance that the persons listed on the attention 
line of the EC would ever receive notification about it. Since FBI employees 
did not search ACS on a regular basis for documents that might be addressed to 
them, they did not learn about leads or other intelligence information assigned 
to them. 


As aresult, we found that none of the supervisors listed on the Phoenix 
EC saw it before September 11. Important judgments were made about how to 
handle the Phoenix EC — which IOS would address the Phoenix EC, closing the 
lead instead of reassigning it, sending the EC to only one person for review, not 
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conducting any research on the recommendations suggested in the EC while 
other matters were being handled — none of which involved any supervisory 
input. This, in our view, is not an appropriate system for handling such 
important information. 


The FBI recognized this problem after September 11 and changed the 
way it handled such information. Rolince told the OIG that once he became 
aware of the Phoenix EC after September 11 and learned how it had been 
handled, he instructed that leads in ITOS had to be assigned to supervisors and 
could not be assigned only to IOSs. 


In addition to deficiencies in the supervisory process, we also believe that 
the FBI’s practice and policies regarding closing of leads were faulty. As 
evidenced by the handling of the Phoenix EC, leads could be closed without 
any work being done on them, other than reassignment to someone else. 


A contributing factor to the ineffective management of the work 
assignments in ITOS was the FBI practice of rotating supervisors through FBI 
Headquarters on a relatively short basis. We found that supervisors typically 
stay in FBI Headquarters for two years or less, and SSA positions and unit 
chief positions often remain unfilled for months at a time. By contrast, IOSs 
remain in ITOS on a permanent basis and are therefore relied upon for their 
expertise and institutional knowledge about counterterrorism programs, 
intelligence on FBI targets, relationships with other intelligence agencies, and 
how FBI Headquarters works. As a result, [OSs sometimes manage 
themselves. While we believe that many [OSs are capable and dedicated FBI 
employees, the turnover of managers in FBI leaves a gap in IOSs’ supervision, 
in addition to making it difficult for managers to be effective and 
knowledgeable about their subject areas before they are sent to a new 
assignment. 


2. Lack of adequate strategic analytical capabilities 


We believe the Phoenix EC warranted strategic analysis. It never was 
subjected to any such analysis before September 11. Ellen and Jane agreed that 
Jane would handle the Phoenix EC, but Jane did not refer it to the entity at the 
FBI that was assigned to conduct strategic analysis, the ISD. She said she 
decided not to refer it to the ISD for analysis and instead keep it for herself to 
work on when she had time. She believed that the ISD did not have sufficient 
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capability to perform timely analysis. At the time, the FBI had no IRS in the 
ISD specifically assigned to handle matters involving Bin Laden, despite the 
importance of that assignment. As we discuss in more detail below, while the 
handful of analysts who worked in the ISD were supposed to perform strategic 
analytical functions, most of their time was spent assisting on case-related 
matters. 


This was a significant failing. A critical component of the work of the 
FBI’s Counterterrorism Division is analysis. Although case-related analysis — 
also called “tactical” or “operational” analysis — is crucial to bringing criminal 
cases to the point of arrest and prosecution and to determining through 
intelligence information whether a particular target or group may be planning 
an imminent terrorist act, strategic analysis is equally important to the FBI’s 
counterterrorism mission. Strategic analysis involves drawing conclusions and 
predictions about terrorist organizations and likely methods of attack based on 
all sources of information. It is critical to the FBI’s ability to be proactive 
instead of reactive as well as to set investigative priorities. It is also critical for 
identifying intelligence gaps in information about a terrorist group or target. 


Since September 11, the FBI has acknowledged that it lacked an effective 
strategic analysis program for international terrorism prior to September 11. In 
congressional testimony, Director Mueller acknowledged the FBI’s analytical 
capabilities prior to September 11 were “inadequate.” He stated that the FBI’s 
analytical capability “[was] not where it should be.” Since then, the FBI has 
focused attention on improving its analytical functions.* 


Prior to September 11, the FBI’s strategic analytical capabilities were 
extremely limited. The FBI did not regularly prepare analytical products that 
predicted trends, explained patterns, or identified national security 
vulnerabilities with respect to international terrorism.” 


83 The OIG is in the process of completing a comprehensive review of FBI’s analyst 
program and it is tentatively scheduled to be completed in September 2004. 


84 A striking example of the FBI’s failing in this regard is documented in a September 
2002 OIG audit report which found that the FBI had not performed a comprehensive 
national-level assessment of the threat and risk of terrorist attack, despite having promised 
Congress that it would do so following a September 1999 General Accounting Office 
(GAO) report. As of September 11, 2001, the FBI had developed a draft of a report that was 
(continued) 
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This lack of strategic analytical capability undoubtedly affected how the 
Phoenix EC was handled. Instead of being able to send the EC to a unit that 
had sufficient expertise and resources to assess the theory laid out by Williams, 
Jane kept it to herself, hoping to find the time to turn to it amid the crush of 
other duties. She was not able to do so before September 11. 


Part of the problem was that, in the past, the FBI did not adequately value 
or support an analytical program. This problem was aptly described by one 
CIA official — one of several CIA managers enlisted by the FBI after 
September 11 to help turn around the FBI’s analytical program — as “a lack of a 
culture of analysis.” The FBI was composed predominantly of agents who 
performed criminal investigative work and who did not appreciate the value of 
strategic analysis. This was particularly acute in the FBI’s Counterterrorism 
Program. As a result, FBI counterterrorism IOSs, SSAs, and managers had a 
tendency to rely on their own experience and professional judgment rather than 
seeking strategic analysis, and the Counterterrorism Program focused on 
immediate, short-term operational priorities rather than strategic analysis. 


Strategic analysis was viewed as a support function rather than its own 
discipline. IOSs and agents employed IRSs primarily to conduct research and 
analysis projects in support of on-going investigations or prosecutions. While 
this research and analysis often involved complex and time-consuming work, 
such as reviewing information collected as a result of a FISA warrant or 
establishing the connections between targets in a case based on a review of 
telephone records, it was normally in furtherance of a specific investigation. 


Furthermore, several IRS employees we interviewed told the OIG that 
IRSs often were used to perform the work that IOSs did not like to do, such as 
conducting name searches in ACS or performing research on the Internet. A 


(continued) 

purportedly the threat assessment. The OIG reviewed a draft of the report in May 2002. We 
concluded that it was not a threat assessment because it did not describe the nature of the 
terrorist threat, identify critical intelligence requirements, or make recommendations to any 
level of FBI management. See “A Review of the Federal Bureau of Investigation’s 
Counterterrorism Program: Threat Assessment, Strategic Planning, and Resource 
Management” (May 2002). In January 2003, the FBI issued an intelligence assessment 
entitled “The Terrorist Threat to the U.S. Homeland: An FBI Assessment,” which 
responded to the recommendations in our September 2002 audit report. 
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CIA manager detailed to the FBI told the OIG that IRSs were considered 
“second class citizens” at the FBI. This view of analysts reduced the ability of 
the FBI to conduct the strategic analysis that was needed on projects such as 
the Phoenix EC. 


Another example of how the strategic analytical function was subordinate 
to the operational function in the FBI’s Counterterrorism Program is evident in 
the fact that 5 IRSs were absorbed into an operational unit in late 2000, when 
there were fewer than 20 IRSs devoted to international terrorism at the time. 
These IRSs were assigned in late 1998 to the UBLU to conduct research and 
complete other tasks in support of the investigation and prosecutions stemming 
from the embassy bombings in East Africa. These were important assignments 
that needed to be done, but they made it more unlikely that strategic analysis, 
such as the kind warranted by the Phoenix EC, would be accomplished. 


In addition, the primacy of the operational units was further demonstrated 
by the fact that the judgments and conclusions of IRSs set forth in analytical 
products could be overruled or blocked from dissemination by the managers in 
the operational units or the ITOS section chief. Witnesses told the OIG that 
operational personnel were permitted to prevent dissemination of analytical 
products. For example, IRSs told the OIG that a proposal for an analytical 
report that would have discussed signs that al Qaeda was planning a terrorist 
attack was stopped by a New York Field Office supervisor because of concerns 
that the information could be subject to discovery in a prosecution. 


Witnesses also told the OIG that operational units’ ability to override the 
conclusions of the IRSs was demoralizing to the analytical component. CIA 
analysts detailed to the FBI after September 11 to revamp its analytical 
program asserted to the OIG that operational personnel, whose expertise is 
case-oriented and therefore tactically based, should be involved in checking the 
facts presented in the analytical product but should not be able to alter or block 
the dissemination of analytical results. 


While there are legitimate tensions between operational and analytical 
personnel, the FBI had no process before September 11 for addressing conflicts 
that arose out of this tension. 


86 


3. Resources and training for analysts 


The FBI’s strategic analytical function also was under-resourced. This 
was demonstrated by the shortage of IRSs and the lack of training offered to 
them. We interviewed former IRS managers about the resources of the ISD 
prior to September 11. The FBI acknowledged that the number of IRSs 
working on counterterrorism matters had dwindled prior to September 11, and 
that the few remaining IRSs were not sufficient to address the analytical needs 
of the ISD. 


In 1996, the FBI had hired 36 IRSs in an effort to bolster its international 
terrorism analytical program. According to witnesses, within a year 
approximately half of the IRSs had left the program. By mid-1999, there were 
only approximately 15 international terrorism IRSs, and by mid-2000 there 
were only 10 IRSs devoted to counterterrorism analysis.” Former IRS 
managers confirmed to us that only one IRS was assigned to UBL matters in 
2001, but she transferred to another unit in July 2001. Thus, in the summer of 
2001 when the Phoenix EC was received, no IRS was assigned to work on Bin 
Laden matters. Jane pointed to this void as one reason she did not seek 
analysis of the Phoenix EC. 


In addition, we found that training for analysts at the FBI was ad hoc and 
untimely. While special agents were sent to Quantico to the FBI Training 
Academy for a 16-week course, IRSs did not receive equivalent training at 
Quantico or elsewhere. IRSs received mostly on-the-job training until they 
could attend a CIA or Defense Intelligence Agency course on international 
terrorism. For some IRSs, this did not occur until they had been working for a 
year or more. In addition, IRSs told us they had to seek training on their own, 
and if they changed program areas they also had to find appropriate training in 
the new subject matter.”° 


3 Some IRSs left the FBI, while others transferred to other positions within the FBI. 
FBI documents show that 10 IRSs became IOSs in ITOS, 8 moved to other positions within 
the FBI, and 13 left the FBI. In addition, as discussed above five of the IRSs who became 
IOSs were administratively transferred to the UBLU after working on a task force in support 
of the embassy bombings case. 


8° While this section of the report primarily focuses on resource and training issues for 
IRSs, IOSs also were not provided with adequate resources and training. 
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Counterterrorism IRSs also lacked a clear career path. They usually were 
supervised and managed by agents, who were not trained about the IRS 
position, mission, or work product. Moreover, CIA managers detailed to the 
FBI to improve its strategic analytical capabilities told the OIG that in order for 
analysts to be taken seriously, they had to hold positions of authority. As an 
example, they stated that in the CIA one of the Deputy Directors was an 
analyst.” According to another CIA manager, the lack of a career path for 
IRSs was a Clear indication that IRSs were not valued by the FBI. 


The result of these deficiencies was a weak and underutilized analytical 
function, which in our view contributed to the lack of attention that the Phoenix 
EC received when it was sent to FBI Headquarters. 


4. Poor information flow and information sharing 


The FBI also has acknowledged that the Phoenix EC contained 
information that should have been disseminated and reviewed by other parts of 
the FBI and the Intelligence Community. While the Phoenix EC did not 
contain information that constituted an imminent threat or warning of a 
terrorist attack, the FBI should have obtained input from within and outside the 
FBI to properly analyze Williams’ theory. However, before September 11 the 
Phoenix EC was not disseminated widely within or outside of the FBI. 


When Jane received the EC, she decided not to disseminate it 
immediately. She believed it lacked sufficient factual support to warrant 
immediate dissemination, and she said she decided to conduct some initial 
research before deciding whether to invest additional resources on the EC. 
Because of her other work, she did not begin the research prior to 
September 11. 


Her actions were consistent with the FBI’s policies and procedures at the 
time. As noted above, IOSs were permitted to exercise discretion in handling 
their assignments, including determining what information to share both within 
and outside the FBI, without supervisory approval. The FBI provided them no 
guidance or requirements on what type of information should be shared, either 


87 Within the Counterintelligence Program, the highest position held by an analyst was 
Section Chief. 
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inside or outside the FBI. This left to the discretion of the individual analyst 
decisions about what to do with intelligence information, such as the Phoenix 
EC. 


We believe exercise of such significant discretion resulted in a failure to 
share important information such as the Phoenix EC. Fundamental to the 
effectiveness of an intelligence operation is its ability to collect and 
disseminate information within and outside the agency. Such information is 
needed by operational personnel to inform their investigations or other 
operational goals. Moreover, in the analytical process, the more information 
that is available about a terrorist organization or a target, the better informed 
conclusions and predictions about the likely actions of the person or 
organization. Information should be reviewed, among other things, to 
determine what would be useful in other FBI investigations, what other 
personnel or offices within the agency should be provided with the 
information, what would be useful for other government agencies, what would 
be useful and appropriate to disseminate to foreign governments, and what can 
be declassified for use in public alerts. 


But information sharing within and outside the FBI’s Counterterrorism 
Program prior to September 11 was piecemeal and ad hoc rather than 
systematic. Several of the CIA managers detailed to the FBI told the OIG that 
there was no “information flow” within the FBI. The FBI’s process for 
disseminating information was to route information primarily to IOSs, who 
then used their own judgment and experience to decide what needed to be 
disseminated and to whom. As discussed above, IOSs were operating with a 
“triage” approach to their workload. They had to identify what information 
was the most significant and deal with the crises or problems as they arose. As 
a result, information that did not demand immediate attention or did not relate 
to a crisis took significant time to be addressed, if it was addressed at all. 


The CIA managers we interviewed asserted that an intelligence agency 
must set priorities to identify what its information needs and intelligence gaps 
are. They said that once priorities and intelligence gaps are identified, 
decisions can be made about what information should be collected and who 
should receive the information. They explained that these decisions should 
then be communicated throughout the agency as “requirements.” 
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Several of the CIA managers also noted that the FBI lacked any priorities 
or requirements for the dissemination of information once it was collected. For 
example, there was no guidance concerning what types of information were 
required to be disseminated or included in reports to other intelligence 
agencies. Moreover, there were no requirements that certain types of 
information be routed to analysts or that analysts be copied on particular kinds 
of communications. IOSs simply shared or disseminated the information they 
believed needed to be shared based primarily on their prior experience.” 


IOSs we interviewed told the OIG that they spent a majority of their time 
preparing documentation for requests for FISA warrants. They also were 
responsible for providing advice and assistance to the field offices in 
connection with ongoing investigations and with responding to threats of 
terrorist acts. They also had to obtain resources to support investigations, such 
as arranging for translators or preparing documentation for re-allocation of 
money. They needed to respond to requests to check telephone numbers, 
names, and other identifying information about targets of investigations in FBI 
and CIA databases. While the IOSs acknowledged that collection and 
dissemination of intelligence information was one of their responsibilities, they 
stated that as a job function it was not a priority before September 11. 


Several IOSs stated that it was impossible for IOSs to be aware of and 
disseminate every piece of information generated by every lead because of the 
demands of the other responsibilities of their jobs. As a result, they said that 
they had to focus on the most significant information that was generated from 
important cases or credible threats. Jane, other IOSs, and special agents told us 
that the type of intelligence information that received immediate attention was 
that generated from explicit threats of an attack or other terrorist act, 
information that a terrorist who was in custody was being brought to the United 
States, or intelligence intercepts by another agency that led to a name and 
phone number in the United States of a target. Other information was handled 
if there was time. 


88 We also discuss the FBI’s lack of policies and procedures for information sharing in 
our December 2003 OIG audit report, “The Federal Bureau of Investigation’s Efforts to 
Improve the sharing of Intelligence and Other Information” (December 2003) at 19-20. 
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By contrast, according to the CIA personnel, the dissemination of 
intelligence information requires full-time personnel trained solely for that 
purpose. In the CIA, dissemination of intelligence information is handled by 
“reports officers” who are professional employees trained in analysis and 
information collection and dissemination. 


It also was clear in our review of the Phoenix EC that the FBI’s 
procedures for disseminating information internally were cumbersome. At the 
FBI, many layers of review were required to distribute an EC to multiple field 
offices. Disseminating an EC to all FBI field offices required approval from 
several supervisors and managers, including the FBI Director. Several 
witnesses stated that the review and approval process normally took several 
weeks to complete. The CIA employees detailed to the FBI to improve the 
analytical program who we interviewed told the OIG that they found the 
process for completing an EC was “difficult” and “hard.” 


We believe that the Phoenix EC should have been shared with the 
Intelligence Community or parts of the Intelligence Community for their input 
and analysis. While Williams had advanced only a theory, and there needed to 
be more analysis of the recommendations before they were adopted, the EC 
should have been presented to others in the FBI and the Intelligence 
Community for their information and analyses. The fact that it was not 
disseminated reflected the longstanding problem within the FBI of information 
sharing being ad hoc and piecemeal. Rather than relying on the judgment of 
IOSs about what information should be disseminated as they juggle their other 
job duties, the FBI should have a system in place to guide, identify, and 
prioritize the kinds of information that need to be shared. 


5. General complaints about the difficulties of working in ITOS 


We also heard consistently from witnesses in ITOS that working there 
before September 11 was extremely chaotic and difficult. They complained 
that all aspects of their jobs — from putting FISA packages together to 
disseminating intelligence to sending out ECs to the field — were hampered by 
the lack of resources and poor technology. 


IOSs, agents, and managers uniformly told the OIG that IOSs did not 
have sufficient time to handle the workload in ITOS, and that because of the 
lack of resources in ITOS and the demands of operational matters in the 
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section, they worked extremely long hours on a regular basis, including nights 
and weekends. They described being overwhelmed with work, including 
intelligence information that needed to be disseminated. For example, they 
said that hundreds of leads could be generated by any one case. They stated 
that the demands of a particular case or a particular threat sometimes consumed 
all of their time and attention for several days or even weeks. As previously 
discussed, they were operating with a “triage” approach to their workload in 
which they dealt with crises or priority problems as they arose. We found that 
as aresult, issues that they considered to be non-priority matters, such as the 
Phoenix EC, often were placed on the backburner. 


FBI and CIA witnesses also uniformly complained that the FBI’s 
computer system — ACS — impeded the flow of information. As we have 
discussed in several other OIG reports, ACS is a very cumbersome and non- 
user-friendly system that discourages its use.® To disseminate information 
within the FBI was not simply a matter of forwarding an electronic document 
in a point and click e-mail environment. Rather, an IOS would have to prepare 
an EC, which required accessing several different screens in ACS to complete 
and then upload the EC.” In addition, witnesses complained that ACS 
especially hampered the flow of information because it was not a system 
designed to “push” information out to the user. Instead, the user had to know 
that information existed in order to find it. As discussed above, this resulted in 
the Phoenix EC not being reviewed by the appropriate individuals, even when 
their names were on the attention line. 


8 See, e.g., OIG reports entitled, “The Federal Bureau of Investigation’s 
Implementation of Information Technology Recommendations,” (September 2003); “FBI’s 
Management of Information Technology Investments” (December 2002); “An Investigation 
of the Belated Production of Documents in the Oklahoma City Bombing Case” (March 
2002); and “The Handling of FBI Intelligence Information Related to the Justice 
Department’s Campaign Finance Investigation” (July 1999). 


3 Also, as stated above, ECs that were addressed to all field offices required several 
layers of management approval, which also slowed down the process. 
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B. Individual performance 


We now turn to the actions of the individuals who were involved with the 
Phoenix EC. While the systemic problems hampered FBI employees in 
handling information such as the Phoenix EC, and explained to some extent the 
reasons that FBI employees did not adequately respond to it, these systemic 
problems do not explain all the deficiencies we found in the handling of the 
Phoenix EC. While we do not believe that anyone involved with the Phoenix 
EC at FBI Headquarters committed misconduct, we believe that some of them 
made errors in judgment with respect to some of their actions on the Phoenix 
EC. 


1. Kenneth Williams 


First, we believe that Williams should be commended for his initiative 
and for his attempts to apply broad analytical thinking to his casework. He 
prepared the Phoenix EC based on his experience, intuition, and expertise, and 
he sought assistance through the proper channels at FBI Headquarters in 
pursuing his theory. It was FBI Headquarters’ responsibility — not a field 
office’s responsibility — to decide what strategic analysis was needed to address 
the issues Williams raised and to ensure that appropriate attention was directed 
to the analysis of those issues. Williams deserves praise for, in the midst of 
handling cases in the field, discerning a pattern that he thought warranted 
review and seeking to bring that to the attention of others in the FBI. 


2. FBI Headquarters 


a. Jane 


Jane’s decision not to refer the Phoenix EC to the ISD and instead to 
conduct the necessary research herself did not violate any FBI policies and 
procedures at the time. Leads could be assigned and handled without 
supervisory input, and much was left to IOSs’ discretion and judgment about 
how assignments were handled and prioritized. 


However, we question Jane’s decision not to refer the Phoenix EC to the 
ISD for analysis. While the FBI’s strategic analytical capabilities were 
extremely limited, as we have described above in detail, and no IRS was 
specifically assigned to Bin Laden matters, Jane could have, and should have, 
referred the Phoenix EC to the ISD for analysis. By all accounts, Jane was 
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hard working and conscientious. But the press of other work prevented her 
from addressing the Phoenix EC sufficiently. While she said that she did not 
think that the ISD could do what was necessary to analyze the Phoenix EC 
because no IRS was specifically assigned to Bin Laden matters, she could have 
raised the problem to her supervisor’s attention in an attempt to have resources 
assigned to analyze the Phoenix EC. Instead, she kept the Phoenix EC to 
herself, hoping to get to it when time allowed. But she did not have time for it. 
We believe that, even if she intended to conduct research on it when time 
permitted, she should have provided it to members of the Intelligence 
Community for their input on the theories and recommendations it advanced. 


b. Ellen 


Ellen recognized that the Phoenix EC pertained more to the UBLU than 
the RFU, and she appropriately discussed it with Jane and had the matter 
reassigned to her. She also noted in the disposition field of ACS how the lead 
was being handled. Ellen closed the lead, but rather than closing the lead, she 
should have reassigned the lead to Jane. While this was not inconsistent with 
how leads were handled in ITOS, given the pressure to close leads in the 
system, it misrepresented the status of the lead since the necessary research had 
not yet been completed. 


c. Rob 


We believe that Jane’s supervisor — Rob — should have recognized that 
the requests in the Phoenix EC were not typical requests for operational 
support in the field and should have directed the matter to the ISD. Although 
we recognize that the FBI left much to the discretion and judgment of IOSs 
about how they handled their work, it was Rob’s responsibility as a supervisor 
to ensure that Jane was handling requests appropriately. Jane briefly 
mentioned the Phoenix EC to Rob, but said he did not review it, and we do not 
believe he sought to ensure that it received adequate attention. We believe that 
Rob should have been more actively involved in Jane’s handling of the 
Phoenix EC. If he had decided that resources did not exist to address the EC 
for several months, we believe that he should have brought the matter to the 
attention of his section chief. 


94 


3. Lynn 


Jane sent the EC to Lynn, the IRS who works counterterrorism matters in 
a field office that had had an investigation of Subject No. 2, with a note that 
read, “I thought it would be interesting to you considering some of the stuff 
you were coming up with in [your field office]. Let me know if anything 
strikes you.” Jane did not call Lynn to discuss the Phoenix EC prior to sending 
Lynn the e-mail, and Lynn was not assigned a lead with respect to the Phoenix 
EC. Lynn read the Phoenix EC, but did not respond to Jane’s e-mail, and Jane 
did not otherwise contact her about the Phoenix EC. 


As discussed above, Lynn had several years earlier worked on an 
investigation in which Subject No. 2 had been central, and Subject No. 2’s 
name had resurfaced in June of 2001 when two individuals were detained in 
Bahrain who admitted to being al Qaeda operatives and possessed a passport 
containing the same last name as Subject No. 2 and a previous address of 
Subject No. 2. Lynn told the OIG that after Subject No. 2’s name resurfaced, 
at the request of Jane she researched their associates from when they had lived 
nearby. Lynn told the OIG that she believed Jane had sent her the Phoenix EC 
because Subject No. 2 was mentioned in the EC. Lynn explained that because 
the information in the EC about Subject No. 2 did not impact what she was 
working on and because she was not aware of any information that supported 
Williams’ theory, she did not respond to the e-mail. 


Lynn was not required to respond to the e-mail by any formal FBI policy. 
Her actions were consistent with others in the FBI, who did not address an 
issue unless a lead was assigned to them. But we believe that Jane’s request 
for Lynn to let her know if anything struck her warranted some response, even 
if the response was that Lynn had nothing to support the theory espoused in the 
Phoenix EC. Instead, Lynn did nothing in response to the e-mail. A response 
from Lynn may have caused Jane to take some other step, to seek further input 
from someone else, or to alert Phoenix of the status. Instead, Lynn did not 
communicate with Jane, and the Phoenix EC languished. 


4. Jay 


Jay, an agent on the Bin Laden squad in the FBI’s New York Field 
Office, received and read the Phoenix EC. He told the OIG that he was not 
aware of any information that supported the theory in the EC, and he therefore 
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did not respond to it, either in writing or by contacting anyone in the Phoenix 
office. He also stated that he would have “taken issue” with the conclusions if 
he had responded. Jay was not required to respond to the Phoenix EC, and he 
did not violate any FBI policies and procedures by not responding. 


Yet, although Jay was not required to respond to the lead set for the New 
York Field Office in the Phoenix EC, Williams had asked for analysis and 
comments on his proposal in the text of the EC. Since Jay told us he felt 
strongly that the theory in the Phoenix EC was not supported by the facts, we 
believe he should have contacted Williams or someone in FBI Headquarters to 
discuss the EC to provide his view, given the expertise of the New York office 
on issues involving Bin Laden. But given the disorganization and convoluted 
way that leads were assigned, and the prevailing practice not to respond to 
leads that were not specifically assigned to an agent, it is not surprising that Jay 
did not respond. 


5. FBI management 


Finally, we believe it important to state that the failings in this case go 
well beyond any failings of those individuals who came in contact with the 
Phoenix EC. In our view, the failings were caused in much larger part by the 
FBI’s inadequate and inefficient system for analyzing intelligence information, 
and the lack of attention paid by many levels of FBI managers to strategic 
analysis. This was the responsibility of many FBI managers and employees, 
from the top down, over many years. We believe that the FBI’s lack of focus 
on strategic analysis and its failure to provide sufficient resources and priority 
to analysis were problems attributable to the FBI and many FBI senior 
managers. While some of the individuals who handled the Phoenix EC did not 
do all they should have to address it in a timely way, the larger and more 
important failure was the way the FBI handled intelligence analysis for many 
years before the September 11 attacks. 


C. Other pieces of intelligence concerning airplanes as weapons 


We also reviewed allegations that the FBI had other pieces of intelligence 
information prior to September 11 that indicated connections between persons 
of interest to the FBI and airplanes or flight schools. 
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The FBI provided to the OIG documents relating to possible terrorists 
with connections to airplanes and flight schools that the FBI gathered in 
response to requests from the Joint Inquiry Committee Staff. The FBI 
conducted searches in its computer systems for references to “flight schools,” 
“airplanes,” “hijackings” and other related terms in an attempt to collect 
information that the Joint Inquiry Committee Staff had indicated it was 
interested in reviewing but had not specifically requested. The FBI collected 
the documents retrieved in its electronic searches and provided them to the 
Joint Inquiry Committee Staff and also to the OIG. 


We reviewed the information provided by the FBI that referenced a 
connection between airplanes or flight schools and persons of interest to the 
FBI. The information was from as early as 1983, although most of it was from 
1998 and 1999. Below we briefly describe four of the pieces of information 
that are representative of the kinds of information contained in FBI files about 
airplanes and flight schools at the time the Phoenix EC was received at FBI 
Headquarters: 


e The FBI received an intelligence report in mid-1999 stating that the 
leadership of a terrorist organization other than Al Qaeda had met and 
planned to use students in the United States to gather intelligence on 
infrastructure facilities and public places frequented by Jews. It was 
also reported that students also would be selected to participate in 
terrorist training camps and would be encouraged to attempt to obtain 
private pilot licenses. The intelligence report noted that it was unclear 
why the students would be asked to obtain pilot licenses. In addition, it 
was reported that these students would be instructed to master at least 
two or more different aircraft. It was reported further that the 
leadership of the terrorist organization viewed this requirement as 
being “particularly important” and were believed to have approved an 
open-ended amount of funding to ensure its success.” 


e In August 1998, an intelligence agency advised the FBI’s New York 
Division of an alleged plan by unidentified Arabs to fly an explosive 


°' The FBI later said that in 2002, in connection with the JICI Review, it researched this 
issue and concluded that the information reported was likely a fabrication. 
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laden aircraft from Libya into the World Trade Center. The New York 
Division sent out leads in an attempt to obtain more information about 
the source of the reporting. 


e On May 18, 1998, a Special Agent on the FBI’s Oklahoma City 
Division’s counterterrorism squad prepared an EC documenting his 
contact with an agent from that Division’s surveillance squad, who also 
was the Division’s chief pilot. In the EC, the agent noted that the 
Division pilot had observed “large numbers of Middle Eastern males 
receiving flight training at Oklahoma airports in recent months.” The 
agent also reported that the pilot speculated that light planes would be 
an ideal means of spreading chemical or biological agents. 


e In January 1995, Philippine authorities responded to a small fire and 
several explosions in an apartment in Manila. Inside the apartment, 
authorities discovered bomb-making equipment and terrorist literature. 
The resulting investigation revealed a plot to place explosive devices in 
12 American passenger aircraft. As a result of the FBI’s investigation 
into this matter, Abdul Murad, Wali Shah, and Ramzi Yousef were 
subsequently indicted and convicted in the United States for their 
involvement in the conspiracy. Yousef later was convicted on 
November 13, 1997, for his involvement in the bombing of the World 
Trade Center on February 23, 1993. 


During investigative interviews, Murad described general 
conversations with Yousef in which they discussed the potential use of 
aircraft to commit terrorist acts. According to Murad, he discussed 
with Yousef the ease with which a pilot could conduct a suicide attack 
by crashing an explosive-laden aircraft into a building. Murad 
mentioned CIA Headquarters as a potential target. Murad contended in 
investigative interviews that there was no specific planning in relation 
to any of these acts. Murad also described other general conversations 
with Yousef concerning potential non-aircraft related terrorist acts, 
such as bombing a nuclear facility, utilizing poison gas, and bombing 
the World Trade Center a second time. 


As discussed above, the FBI conducted little strategic analysis before 
September 11, and it never attempted to connect any of these disparate pieces 
of information. For this reason, these pieces of information and all of the other 
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information in the FBI’s possession that might have been used to analyze the 
use of airplanes and civil aviation for terrorist purposes was never considered 
systematically or analytically. 


D. Conclusion 


In sum, our examination of the FBI’s handling of the Phoenix EC found 
that the individuals who handled it did not violate FBI policies and practices at 
the time, but they did not do all they could have, and should have, to respond to 
it or the recommendations in it. They should have sought input from others in 
the FBI, assured that the EC received the necessary analysis, and also sought 
input from the Intelligence Community about the theories and suggestions 
contained in it. 


But we believe that their actions were not surprising, given that the 
policies and practices under which they operated were extremely flawed. We 
found that IOSs were not properly managed and that supervisors should have 
been more actively involved in the work assigned to IOSs. In addition, as an 
institution, the FBI was focused on its operational priorities at the expense of 
conducting strategic analysis. Furthermore, the FBI lacked a systematic 
approach to information sharing and lacked adequate tools to facilitate such 
information sharing both within and outside the FBI. As a result of these 
systemic failures, the FBI did not give the Phoenix EC the consideration that it 
deserved. 


We cannot know for certain what the FBI would have concluded prior to 
September 11 if the FBI had applied strategic analysis to the theory posed by 
the Phoenix EC or what information may have been uncovered in support of 
the theory if the Phoenix EC had been shared with the Intelligence Community 
or within the FBI. We also cannot know what role, if any, the pieces of other 
information described above would have played in the analysis of this question. 
What we do know is that the FBI was not adequately analyzing information for 
the purpose of drawing conclusions and making predictions. This was a 
significant intelligence failure, which hindered the chances of the FBI being 
able to detect and prevent the September 11 attacks. 
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CHAPTER FOUR 
THE FBPS INVESTIGATION OF 
ZACARIAS MOUSSAOUI 


I. Introduction 


This chapter examines the FBI’s investigation of Zacarias Moussaoui. In 
August 2001, Moussaoui enrolled in flight training lessons at a school in 
Minneapolis, Minnesota. On August 15, 2001, the flight school reported its 
suspicions about Moussaoui to the FBI, including that he only wanted to learn 
how to take off and land the airplane, that he had no background in aviation, 
and that he had paid in cash for the course. The FBI interviewed Moussaoui’s 
flight instructor, his roommate, and then Moussaoui. The INS and the FBI 
detained Moussaoui for a violation of his immigration status and seized his 
belongings, including a computer and personal papers. 


The Minneapolis FBI opened an investigation on Moussaoui, believing 
that he was seeking flight training to commit a terrorist act. Over the next 
several weeks, the Minneapolis FBI and FBI Headquarters had many 
discussions — and disputes — about the investigation. Minneapolis wanted to 
obtain a warrant to search Moussaoui’s computer and other belongings that 
were seized at the time of Moussaoui’s arrest, either a criminal warrant or 
Foreign Intelligence Surveillance Act (FISA) warrant. The Minnesota FBI and 
FBI Headquarters differed as to whether a warrant could be obtained and what 
the evidence in the Moussaoui case suggested. FBI Headquarters did not 
believe sufficient grounds existed for a criminal warrant, and it also concluded 
that a FISA warrant could not be obtained because it believed Moussaoui could 
not be connected to a foreign power as required under FISA. The Minneapolis 
FBI disagreed and became increasingly frustrated with the responses and 
guidance it was receiving from FBI Headquarters. 


In late August 2001, after FBI Headquarters concluded that it could not 
obtain a FISA warrant, the Minneapolis FBI began plans to deport Moussaoui 
to France, which had issued Moussaoui’s passport. They planned to ask the 
French authorities to search his belongings if he was deported to France. 
However, the September 11 terrorist attacks occurred while the FBI was in the 
process of finalizing the deportation plans. On September 11, after the attacks, 
the FBI obtained a criminal warrant to search Moussaoui’s possessions. On 
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December 11, 2001, Moussaoui was charged in an indictment alleging that he 
was a co-conspirator in the September 11 attacks. He currently is awaiting 
trial. 


On May 21, 2002, Coleen Rowley, the Minneapolis FBI’s Chief Division 
Counsel (CDC), sent a letter to FBI Director Mueller in which she criticized 
FBI Headquarters for the way it had handled the Moussaoui case. Among 
other things, her letter disputed the way the FBI was describing its Moussaoui 
investigation, and she asserted that FBI Headquarters had prevented the 
Minneapolis FBI from seeking a criminal search warrant. In addition, she 
alleged that FBI Headquarters inappropriately failed to seek a FISA warrant 
even though probable cause for the warrant was “clear.” She also alleged that 
FBI Headquarters had intentionally raised “roadblocks” and “undermined” the 
Minneapolis FBI’s “desperate” efforts to obtain a FISA warrant. She added 
that the Phoenix EC had not been provided to the Minneapolis FBI, and that 
the Minneapolis FBI’s assessment of Moussaoui as a potential threat had not 
been shared with other intelligence and law enforcement authorities. 


Upon receipt of Rowley’s letter, Director Mueller referred it to the OIG 
and asked the OIG to conduct a review of the issues raised in the letter, the 
Phoenix EC, and other matters related to the FBI’s handling of intelligence 
information that was potentially related to the September 11 attacks. 


In this chapter, we describe in detail the facts regarding the FBI’s 
investigation of Moussaoui and the interactions between the Minneapolis FBI 
and FBI Headquarters on the request to obtain a warrant to search Moussaoui’s 
belongings.” We then provide our analysis of these actions. Our analysis 
discusses systemic problems that this case revealed, and it also assesses the 


°° While there are some notes and e-mails relating to the conversations that took place 
between FBI Headquarters and the Minneapolis FBI, and within FBI Headquarters, about 
the Moussaoui investigation, many conversations were not documented. Witnesses could 
not recall the exact content of some of the conversations, the number of conversations, 
whether specific topics were discussed, or the dates of conversations. The following 
narrative is our best reconstruction of those conversations and events, when they occurred, 
and what was said, based on the documentary evidence and the recollections of the 
participants. 
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performance of the FBI offices and employees who were involved in the 
Moussaoui investigation. 


We show a timeline of the FBI’s investigation of Moussaoui on the next 
page of the report. 


II. Statement of facts related to the FBI’s Moussaoui investigation 


A. Mboussaoui’s background 


Zacarias Moussaoui was born in France on May 30, 1968, and is of 
Moroccan descent. Prior to 2001, he lived in the United Kingdom. On 
February 23, 2001, he legally entered the United States in Chicago, Illinois, 
using a French passport. He entered under the Visa Waiver Program, which 
allows citizens of 27 countries, including France, to enter the United States 
without a visa for stays of up to 90 days.” Moussaoui’s entry was therefore 
valid until May 22, 2001. 


In late February 2001 Moussaoui enrolled in a beginner pilot course at 
the Airman Flight School in Norman, Oklahoma. He did not complete the 
training and stopped taking lessons there in late May 2001. However, he 
remained in the United States after dropping out of the course and overstayed 
his allowed length of stay. 


On May 23, 2001, Moussaoui e-mailed the Pan Am International Flight 
Academy, a private aviation school based in Miami, Florida, which had several 
campuses around the country. On August 9, 2001, Moussaoui enrolled in a 
flight simulator training course at a Pan Am facility near Minneapolis, 
Minnesota. Pan Am’s Minneapolis facility used flight simulators only, and the 
training there usually consisted of initial training for newly hired airline pilots 
or refresher training for active pilots. Moussaoui’s flight simulator course was 
part of a comprehensive training program designed to provide instruction to 
licensed pilots on how to fly commercial jets. 


33 For a description of the Visa Waiver Program, see the OIG report entitled “Follow-up 
Report on the Visa Waiver Program” (December 2001). 
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B. The FBI receives information about Moussaoui 


Moussaoui had completed two days of classroom instruction and one 
flight simulator training session to fly a 747-400 airplane (out of a scheduled 
four or five sessions) when a manager at the Minneapolis Pan Am flight school 
contacted the FBI about him. On August 15, 2001, the Pan Am manager called 
the FBI’s Minneapolis Field Office to report that he and his co-workers were 
training a student, Moussaoui, who they considered suspicious. 


According to the Pan Am manager, they considered it odd that 
Moussaoui said that all he wanted to learn was how to take off and land the 
plane, giving the reason that it was “an ego boosting thing.”94 In addition, the 
FBI learned that Moussaoui had no background in aviation and did not have a 
private pilot’s license.95 It was also unusual that Moussaoui had paid $8,000 — 
$9,000 in cash for the course. The Pan Am manager reported that Moussaoui 
appeared to be of Middle Eastern descent and that he had said he grew up in 
France. The manager said that Moussaoui had completed two days of 
classroom instruction and was scheduled for four or five sessions in the flight 
simulator. 


The FBI agent who took the telephone call was assigned to the 
Minneapolis FBI’s international and domestic terrorism squad. Immediately 
following the telephone call, the agent discussed the call with the Acting 
Supervisory Special Agent (SSA) on the Minneapolis FBI’s international and 
domestic terrorism squad, who we call “Gary,” and another agent on the squad 
who handled international terrorism investigations. We call this agent 
“Henry.” 


Gary had become the Acting SSA of the terrorism squad in late July 
2001. Prior to being named the acting supervisor, during his five years as an 
FBI special agent Gary had worked for two years on bank robberies and other 


** Media reports later incorrectly reported that Moussaoui had stated that he did not 
want to learn to take off or land a plane. In fact, according to the FBI, the Pan Am manager 
reported that Moussaoui only wanted to learn to take off and land the plane. 


°° Although Pan Am’s typical students were commercial pilots receiving initial or 
refresher training, this was not a prerequisite to taking the training course. 
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violent crime investigations, two years in the unit responsible for investigating 
fugitives, and one year as the coordinator of the FBI’s Joint Terrorism Task 
Force (JTTF) for the Minneapolis Field Office.” Gary also had served as the 
relief supervisor for the international and domestic terrorism squad. However, 
he had no field experience in terrorism matters and no experience in working 
with FISA. 


Henry had joined the FBI as a special agent in January 1999 and had 
been assigned to work on international terrorism matters since his arrival at the 
Minneapolis office in the spring of 1999. In August 2001, Henry and two other 
agents on the squad handled international terrorism and foreign 
counterintelligence investigations. By virtue of his assignment on the 
counterterrorism squad, Henry also worked on the local JTTF. Prior to joining 
the FBI, Henry served as a naval intelligence officer for almost ten years. In 
the Navy, he specialized in aviation-related intelligence issues, including a 
detail to the Canadian Navy and Air Force, and he was also an intelligence 
officer on staff at the navy fighter weapon school commonly referred to as 
“Top Gun.” Henry said that he had a private pilot’s license and that he flew for 
the FBI as a collateral duty. Henry described himself as having a “working 
knowledge” of aviation. 


When Gary was named the Acting SSA of the squad in late July 2001, he 
was assigned to report to one of two ASACs in the Minneapolis Field Office 
who we call “Roy.” On August 3, 2001, Roy was named the Acting SAC of 
the office and remained in that position until December 2001. Roy had no 
previous experience in terrorism matters. Gary continued to report directly to 
Roy even after he was named Acting SAC. 


In July 2001, an SSA who we call “Charles” became an ASAC in the 
Minneapolis FBI office. For three years, he had been the supervisor of the 
Minneapolis international and domestic terrorism squad. Prior to becoming the 
supervisor, Charles had been an SSA at FBI Headquarters in the domestic 
terrorism section, and he had worked both foreign counterintelligence and 


°° JTTEs combine investigators from the FBI and various federal, state, and local 
agencies in FBI field offices throughout the country to combat terrorism. 
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international terrorism matters in the Los Angeles Field Office for six years 
before his assignment to FBI Headquarters. 


When Charles became an ASAC in Minneapolis in July 2001, he was no 
longer assigned to oversee the counterterrorism programs; that responsibility 
was given to Roy. According to Charles, this was done so that Charles would 
be seen as an ASAC rather than as the supervisor of the office’s terrorism 
programs. When Roy became the Acting SAC, he maintained responsibility 
for the counterterrorism and foreign counterintelligence programs. In August 
2001, when the Moussaoui matter was reported to the Minneapolis office, 
Charles was at a management training class at the FBI Academy in Quantico, 
Virginia. 


C. The Minneapolis FBI’s investigation 


1. The Minneapolis FBI opens an intelligence investigation 


Henry told the OIG that within a half hour of receiving the telephone call 
from the Pan Am manager, the Minneapolis FBI filled out the paperwork to 
open a full field intelligence investigation of Moussaoui. According to Henry, 
the case was opened as an intelligence matter and not a criminal matter 
because, based on the telephone call, the FBI did not have information 
indicating criminal predication, which Henry said in this case would have been 
“something in furtherance of terrorism.” Henry said that, as an initial matter, 
the case was a “classic” intelligence investigation. 


Gary assigned the case to Henry and not the agent who had taken the call 
from Pan Am, because Henry had international terrorism experience and the 
other agent did not. Henry told the OIG that based on his own knowledge of 
aviation, he was concerned about Moussaoui. He said he questioned whether it 
was normal for a person with no previous experience in aviation to be training 
to fly a 747-400 commercial airplane. In addition, Moussaoui’s lack of 
aviation experience made Henry suspicious, because Henry knew that the 747- 
400 airplane had become very automated since the 1970s, could be flown by as 
little as two people, and had user-friendly computer screens rather than the 
many dials and gauges that were in the earlier versions of the airplane. Henry 
said that because of these suspicions, he asked the agent who had initially taken 
the call to call the Pan Am manager back and ask some follow-up questions, 
such as how automated a 747-400 airplane was. 
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2. Initial checks for information 


Henry also ran name searches in ACS and learned that the name 
“Moussaoui” was predominantly Lebanese. Henry did not find any 
information in ACS about Zacarias Moussaoui. Henry learned that the last 
name “Moussaoui,” which did appear in ACS records in several places, was 
most often attached to individuals from Lebanon and the terrorist organization 
Hizbollah. 


Henry contacted an SSA in FBI Headquarters who he knew and who we 
call “Jack.” He worked in the unit in ITOS that handled cases dealing with 
Hizbollah. In addition, Gary notified Jack that the Minneapolis FBI had 
opened a full field intelligence investigation on Moussaoui. 


Henry obtained from Pan Am Moussaoui’s passport information and 
learned that Moussaoui had entered the U.S. on a French passport from 
London, England. Henry sent an e-mail on August 15 to the FBI’s Paris Legat 
requesting any available information on Moussaoui from the French 
authorities. Henry also requested similar information from the FBI’s London 
Legat. 


Also on August 15, at the request of the FBI an INS agent assigned to the 
Minneapolis JTTF ascertained from INS records that Moussaoui had stayed 
beyond the 90-day time limit allowed by his entry into the United States under 
the Visa Waiver Program. The INS agent reported to Henry that Moussaoui 
therefore was subject to arrest on immigration charges for overstaying his 
permitted time of entry. 


3. The investigation continues 


On August 16, Henry and two INS agents who worked on the JTTF 
began conducting interviews and collecting information about Moussaoui. The 
FBI interviewed Moussaoui’s flight instructor at Pan Am, an experienced pilot 
and flight instructor for several years. He characterized Moussaoui as unlike 
any other student with whom he had ever worked. He told the agents that 
Moussaoui seemed to have a genuine interest in aviation but Moussaoui had no 
background in any type of sophisticated aircraft systems and had only 
approximately 50 hours of flight training in light civil aircraft that did not 
resemble a 747-400 plane. The agents also learned that Moussaoui had stated 
that he was attending flight school to go on a “joy ride” and that he claimed 
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that he would “love” to fly a simulated flight from London’s Heathrow Airport 
to New York’s John F. Kennedy Airport in one of his scheduled simulator 
sessions. 


According to the flight instructor, Moussaoui also showed a particular 
interest in the “mode control panel” of the flight simulator, which is the 
machinery that enables computerized flying. Moussaoui had demonstrated that 
he already knew how to use the mode control panel during the one simulator 
session that he had completed. Henry told the OIG that he found this 
information ominous because of Moussaoui’s statement that he was attending 
flight school to go on a “joy ride.” This concerned Henry because, based on 
his experience as a pilot, he knew that a joy ride consists of actually flying the 
plane, not allowing the computer to do the flying. 


The flight instructor also reported that although he had initially raised the 
subject, Moussaoui had seemed extremely interested in the aircraft doors and 
their operation and that Moussaoui seemed surprised to learn that the doors 
could not be opened during flight because of the air pressurization in the cabin. 


The flight instructor described Moussaoui as amiable but also “extremely 
reticent” to discuss his background. The flight instructor said that in a 
conversation in which he told Moussaoui about a well-known aviation accident 
involving a group of Muslims, the flight instructor asked Moussaoui whether 
he was Muslim. After reacting with surprise and caution, Moussaoui stated 
that he was not. 


The flight instructor provided the agents with the name of the hotel where 
Moussaoui was staying. The flight instructor said that he had seen Moussaoui 
in the company of another Middle Eastern male and gave a description of their 
vehicle. 


4. The decision to arrest Moussaoui 


On August 16, the agents learned that Moussaoui’s next scheduled 
training session was that evening. Henry asked the INS agents to arrest 
Moussaoui in order to prevent him from receiving any further training. Henry 
said that he was concerned that if Moussaoui completed the training and was 
later arrested and deported, he would be able to use his training in the future. 
Henry said that he wanted to arrest Moussaoui because “there were enough 
indications that [Moussaoui’s behavior] was sinister.” Henry also noted that 
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Moussaoui had paid for his training in cash, which Henry described as 
“unusual,” since most of the students are pilots whose training is paid for by 
the airline which employs them. In addition, Henry said that the fact that 
Moussaoui was not a typical student, since he was not a new or experienced 
pilot and did not even have a pilot’s license, was another factor that made 
Henry suspicious of him. These characteristics were inconsistent with students 
the Pan Am representatives had dealt with before. 


Henry spoke on the telephone with SSA Jack in FBI Headquarters about 
the decision to arrest Moussaoui. According to Henry, Jack suggested that it 
would be better to conduct surveillance of Moussaoui and his companion rather 
than to immediately arrest Moussaoui. This surveillance would allow Henry to 
collect more information about Moussaoui’s connections to others and his 
intentions. Henry told Jack, however, that the decision already had been made 
to arrest Moussaoui because the Minneapolis FBI was concerned about him 
receiving any more flight training. 


Jack told the OIG that, in most cases, conducting surveillance and asking 
the CIA to check its records on information already collected, such as the hotel 
records, is advisable because it results in obtaining additional information about 
the subject. However, Jack said that he also understood the Minneapolis FBI’s 
position that it wanted to arrest Moussaoui immediately to prevent him from 
receiving additional training. 


After discussing the issue with Jack, Henry called his supervisor, Gary, to 
discuss Jack’s position that Moussaoui should be put under surveillance. Gary 
told the OIG that he also believed that it was necessary to arrest Moussaoui to 
prevent him from receiving further training. In addition, Gary believed that it 
was appropriate for the field office to decide to make an arrest, even if FBI 
Headquarters disagreed, and he advised Henry to go ahead with the arrest.” 


97 We recognize that there were good arguments to be made for either arresting 
Moussaoui or for conducting additional surveillance on him. For example, if the agents had 
waited to arrest Moussaoui and conducted surveillance, they may have uncovered more 
information about his associates and his plans. On the other hand, there are serious risks 
involved in trying to surveil an individual — especially a transient one like Moussaoui — who 
could slip away and be lost altogether. Further, as Henry noted, if Moussaoui were allowed 
(continued) 
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5. Moussaoui’s arrest 


At approximately 5:00 p.m. on August 16, Henry and three other agents, 
two of who were INS agents, went to Moussaoui’s hotel to arrest him. They 
stopped Moussaoui and another man as they were getting into a car outside of 
their hotel. Henry and one of the INS agents questioned Moussaoui about his 
immigration status. Moussaoui claimed that he was in the country legally and 
that he had a paper in his hotel room that would prove this. 


In response to questions about his immigration status, Moussaoui 
presented his passport case to the agents. The passport case contained a bank 
statement indicating that Moussaoui had deposited $32,000 in cash upon 
arriving in the United States. The passport contained a Pakistani visa 
indicating that Moussaoui had been in Pakistan for two months — December 9, 
2000, to February 7, 2001. 


The agents accompanied Moussaoui into his hotel room where 
Moussaoui produced an INS document. The document indicated that 
Moussaoui had filed with the INS an application for an extension of stay, but 
there was no evidence that any extension had been granted.” 


Moussaoui’s hotel room was scattered with papers. Henry asked if the 
agents could search the room to see if they could find additional documents 
that would indicate Moussaoui was in the country legally. Moussaoui refused 
this request and refused to allow the agents to search the room or his 
possessions. 


Because it was clear at that point that Moussaoui was in the country 
illegally, the INS agents arrested him. Incident to the arrest, they searched 
Moussaoui and the bag he had been carrying. They found a knife in his pocket, 
cash in his money belt, and flight-training materials from Pan Am in the bag. 


(continued) 
to continue his training and later was deported without any criminal charges, he would have 
achieved his goal of obtaining flight training that could be used at a later time. 


%8 Tn certain circumstances non-immigrant visitors are permitted an extension to stay 
beyond the initial period allowed by the INS upon entry into the country. Pursuant to the 
requirements of the Visa Waiver Program, however, Moussaoui would not have been 
eligible for such an extension. 
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The other man with Moussaoui at the time of his arrest was Hussein Ali 
Hassan Al-Attas (Al-Attas), the owner of the car. The agents detained Al- 
Attas, who consented to a search of his car. The agents found in the car 
another knife, which Moussaoui admitted was his. 


Henry and one of the INS agents remained at the hotel to conduct an 
interview of Al-Attas in the hotel room. The other two agents took Moussaoui 
into custody and transported him to the INS District Office for processing. 


6. Search of hotel room and Al-Attas’ possessions 


According to FBI documents, prior to interviewing Al-Attas the agents 
asked for and received his permission to search some bags that were within his 
reach in the hotel room. To check for weapons, the agents opened several bags 
that Al-Attas told them belonged to Moussaoui. The agents noticed in the bags 
a laptop computer, spiral notebooks, numerous aviation study materials, a 
cellular telephone, and a small “walkie-talkie” radio. The agents did not search 
these items further. 


With the assistance of Al-Attas, the agents collected Moussaoui’s 
belongings, including his bags and papers, from the hotel. Moussaoui 
subsequently gave verbal permission for the FBI to store his belongings at the 
INS District Office, but he refused to allow his belongings to be searched. 


At the hotel, Al-Attas gave the agents permission to search the room and 
Al-Attas’ belongings in the room. From the search of Al Attas’ belongings, the 
agents obtained telephone numbers, personal address books, credit card and 
bank records, and numerous personal documents. The agents found several 
sheets of paper written in Arabic, which Al-Attas identified as his will, and a 
pamphlet advising how to prepare a will.” In addition, the agents found a 
partially completed application for a Pakistani visa, padded gloves, shin 
guards, binoculars, hiking boots, Power Point 2002 computer software, and a 
document indicating that Moussaoui intended to purchase a handheld Global 
Positioning System receiver and rent a camcorder. 


9? The sheets of paper identified by Al-Attas as his will were in a mailing envelope. 
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7. Interview of Al-Attas 


Henry and an INS agent interviewed Al-Attas at the hotel. During the 
interview, Al-Attas — a 21-year-old Yemeni citizen whose family was living in 
Saudi Arabia — stated that he was in the United States on a student visa and had 
been an undergraduate student at the University of Oklahoma for several years. 
He provided documentation to the agents indicating that he had a valid student 
visa that had first been issued in 1995 and that he met the requirements for 
residing in the United States with the student visa. 


Al-Attas stated that approximately one month earlier, he had moved into 
an apartment near the University of Oklahoma, in Norman, Oklahoma, with an 
acquaintance. Unbeknownst to Al-Attas, Moussaoui had just before that 
moved into the apartment with the same acquaintance.'” Al-Attas said that he 
had known Moussaoui for six months and had met him through the mosque in 
Norman that Al-Attas attended regularly. He said that Moussaoui was studying 
aviation in Norman at the time that they first met. 


Al-Attas said that he had accompanied Moussaoui to Minnesota as a 
friend and was not enrolled in any flight school. Al-Attas also stated that he 
knew Moussaoui only by the name of “Shaqil” and that Moussaoui did not 
reveal his last name. 


Al-Attas described Moussaoui as an extremely religious Muslim who had 
gained a reputation at the mosque for being too hard-line and outspoken. 
According to the EC prepared by Henry about the interview, Al-Attas was 
asked if he had ever heard Moussaoui “make a plan to kill those who harm 
Muslims and in so doing become a martyr.” Al-Attas responded that he “may 
have heard him do so, but that because it is not in his [Al-Attas’ ] own heart to 
carry out acts of this nature, he claimed that he kept himself from actually 
hearing and understanding.” 


The Minneapolis agents determined that Moussaoui had traveled to 
Pakistan, as well as to Morocco, Saudi Arabia, and Europe. They also obtained 
the first and last names of one associate of Moussaoui’s in Oklahoma and the 


10 The acquaintance was an Indian Muslim. The FBI ran a name check in its computer 


records for Ali but found no information on him. 
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first name of another of Moussaoui’s associates in Oklahoma. When Al- 
Attas was asked to explain why he and Moussaoui had padded gloves and shin 
guards, he responded that Moussaoui had purchased a set of each for them so 
that they could train to protect themselves against crime in the United States. 
Al-Attas also stated that Moussaoui advocated that “true Muslims must prepare 
themselves to fight,” and that at Moussaoui’s urging Al-Attas had begun 
martial arts training. 


Henry asked Al-Attas if he would be willing to go on jihad, which Henry 
told the OIG he defined for Al-Attas as “holy war.” Al-Attas said he knew 
what it meant, and he would be willing to fight, but currently he was studying. 


Al-Attas also stated that Moussaoui believed it is the highest duty of 
Muslims to know of the suffering of Muslims in the lands where they are 
oppressed, and because the United States is full of unbelievers Muslims should 
not reside in the United States. 


In response to questions about his will, Al-Attas said that it was common 
for Muslims to write their wills and that he had written his a long time ago. 
Al-Attas also was asked why he was in possession of a partially completed visa 
application to travel to Pakistan. He responded that he had been asked by his 
family to go there to research treatments for liver cancer to assist an uncle 
living in Saudi Arabia. 


Al-Attas said that he and Moussaoui planned to travel around the United 
States for two weeks after Moussaoui’s training was completed. According to 
Henry’s EC, Al-Attas could not explain how he would be able to start his 
college classes at the end of the month if he was planning to travel with 
Moussaoui. 


Al-Attas was not detained but was asked to come to the INS District 
Office the next day for further questioning, which he agreed to do. 


Henry told the OIG that after the Al-Attas interview, he was 
unequivocally “convinced . . . a hundred percent that Moussaoui was a bad 
actor, was probably a professional Mujahedin and this wasn’t a joyride, that he 


101 EBI records show that these two names were later checked in ACS, but no 


information was found on them. 
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was completely bent on use of this aircraft for destructive purposes.” Henry 
also stated that he believed that Al-Attas was “telling us as much as he could 
culturally” that Moussaoui was involved in a “plot.” 


8. Interview of Moussaoui 


After interviewing Al-Attas on August 16, Henry and an INS agent 
interviewed Moussaoui that same evening in detention in the INS offices near 
Minneapolis. Henry told the OIG he believed that Moussaoui was 
“combative” and “deceptive” throughout the interview. 


According to Henry’s later 26-page EC documenting the Minneapolis 
FBI’s investigation of Moussaoui (which we discuss in detail in Section E 
below), Moussaoui stated he had come to the United States to be a pilot and 
had been a student at the Airman Flight School in Norman, Oklahoma. He said 
that he had taken the Federal Aviation Administration (FAA) written exam to 
become a pilot but had failed it. Moussaoui said the instructors in Oklahoma 
told him that he was not cut out to be a pilot. He said that he was determined 
to “follow his dream” of flying a “big airplane,” and for pure enjoyment he had 
enrolled in the flight simulator training course at Pan Am in Minneapolis. He 
said that once he completed the simulator course, he planned to return to his 
efforts to obtain a pilot’s license. Moussaoui stated several times during the 
interview that it was very important for him to return to finish the flight 
simulator training. 


Henry reported that Moussaoui could not identify his source of income. 
Moussaoui claimed to have worked as a freelance marketing researcher and at 
various other business ventures, one of which involved an Indonesian 
telephone card company. According to Henry, however, Moussaoui could not 
provide a convincing explanation for the $32,000 in his checking account, and 
he was unable to provide an approximate income for the previous year. 


Moussaoui said that he had traveled to Malaysia, Indonesia, and Pakistan 
in connection with an Indonesian business, as well as to Morocco, Saudi 
Arabia, and all over Europe. When asked why his passport did not reflect entry 
or exit stamps for Indonesia or Malaysia, Moussaoui stated that the passport 
had been issued recently to replace one that had been ruined in the washing 
machine. Moussaoui refused to answer whether he went anywhere else outside 
of Pakistan while he was in Pakistan and, according to Henry, became upset 
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that he was being asked about his travels to Pakistan. '°* Moussaoui denied that 


he had ever had any weapons training, but Henry believed he was deceptive in 
this response. 


Moussaoui was questioned about his religious beliefs. He stated that he 
considered himself a religious Muslim and that he followed the Islamic 
practice of praying five times per day and helping his fellow Muslim brothers. 
When asked about his feelings about the treatment of Palestinians in Israel, 
Moussaoui said that it made him sad but denied that it made him angry. When 
asked whether he had spoken openly about hurting people in retaliation for 
what was happening in Israel, he stated that he needed to think about the 
question, and ultimately he refused to answer it. 


When asked what his immediate plans had been after his flight simulator 
training, Moussaoui stated that he and Al-Attas had planned to travel to New 
York to see the sights and to Denver, Colorado, to do some unspecified 
business with United Airlines. He said he then planned to go to Oklahoma and 
then return to the United Kingdom. 


9. Minneapolis FBI’s consultation with Minneapolis United 
States Attorney’s Office 


During the evening of August 16, after Moussaoui’s arrest, Gary paged 
the “duty attorney” at the Minneapolis United States Attorney’s Office 
(USAO), who that evening was an Assistant United States Attorney (AUSA) 
who we call “Wesley.” Gary left a message for Wesley stating that he needed 
to discuss a criminal search warrant. According to Wesley, when he called 
Gary back around 8:00 p.m., Gary told him that the FBI no longer needed a 
search warrant immediately because the FBI was holding onto his belongings 
while he was being detained. Gary told him that he would get back in touch 
the next day to discuss the issue further. Wesley told Gary that when he called 
back the next day he should talk to the supervisor who was the coordinator for 
terrorism matters, an AUSA who we call “Megan.” 


102 Henry said he knew that persons interested in attending terrorist training camps in 


Afghanistan were known to enter Pakistan first and cross the border into Afghanistan, with 
no indication on their passports of having traveled to Afghanistan. 
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Gary told the OIG that he had called the USAO because he was unsure 
whether a criminal search warrant could be obtained, since Moussaoui was 
arrested by the INS on an immigration violation. According to Gary, he 
provided Wesley with a hypothetical with little information, because Gary was 
not sure how much information he was permitted to share with the USAO in 
light of the fact that the investigation was opened as an intelligence 
investigation and not a criminal investigation. Gary said that he asked Wesley 
if they were “close” to getting a criminal search warrant, and Wesley told him 
that it “sounds close” but that Gary should “freeze the scene” and call Megan 
the next day, since Wesley was not familiar with that type of case. 


Wesley told the OIG that, based on what he was told at the time, he had 
believed that there was sufficient probable cause to obtain a criminal search 
warrant. He added that if the Minneapolis FBI had wanted to obtain the search 
warrant that evening, he would have sought the warrant and would not have 
needed supervisory approval to do so. 


Following his conversation with Gary, Wesley called Megan on her cell 
phone and left her a message about the case. The next day, Wesley drafted a 
memorandum to Megan summarizing his conversation with Gary, in which he 
wrote, “The FBI would like to search the computer, and likely the other 
property. The suspect is being held, and questioned, by INS. [Gary] said that 
he will be off today, and that [another Minneapolis FBI agent] or [Henry] will 
stop by today to talk with you about the case.” 


Megan told the OIG that Wesley conveyed to her in his message on the 
evening of August 16 that the Minneapolis FBI had arrested Moussaoui and 
was interested in obtaining a search warrant, but not that night. When the 
USAO did not hear back from the Minneapolis FBI, Megan called Henry the 
next day, August 17, and left a message for him. According to Megan, Henry 
did not return her call until August 20. He told her that according to the 
Attorney General Guidelines he could not discuss the case with her without 
FBI Headquarters and DOJ approval, since the case had been opened as an 
intelligence matter. 


Megan told the OIG that she did not know if probable cause existed 
before September 11 to obtain a criminal search warrant in the Moussaoui case. 
However, she stated her belief that if the FBI had indicated that it was ready to 
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pursue the search warrant, it would have been the “normal course” for the 
USAO to try to obtain the warrant. 


10. Al-Attas’ arrest 


On August 17, the day after Moussaoui’s arrest and Al-Attas’ interview at 
the hotel, Al-Attas came to the INS District Office, as requested by the FBI, and 
was interviewed again by FBI and INS agents. During this second interview, Al- 
Attas stated that Moussaoui had associated with two Pakistani flight instructors 
and two flight students in Oklahoma, one from Saudi Arabia and one from 
Bahrain. In addition, Al-Attas said that Moussaoui followed the teachings of a 
sheikh, whose identity Moussaoui had not revealed to Al-Attas because 
Moussaoui believed that Al-Attas would not approve of this sheikh’s views.” 
When asked if the person was Usama Bin Laden, Al-Attas stated that he did not 
believe so, and that the only reference Moussaoui had made to Bin Laden was to 
comment on his appearance on television. Al-Attas also gave the agents the first 
and last names of one associate of Moussaoui’s in Oklahoma and the first name 
of another of Moussaoui’s associates in Oklahoma. '™ 


During this interview, Al-Attas admitted that he had worked while he was 
going to school at the University of Oklahoma. Because this was a violation of 
his student visa, the INS arrested Al-Attas and took him into custody. 


Also on August 17, Henry and other agents interviewed Moussaoui 
again, and documented the results of the interview. 


11. Second interview of Moussaoui 


On August 17, Henry and other agents interviewed Moussaoui again. 
According to Henry’s 26-page EC, which included information about both 
interviews, Moussaoui attempted to appear cooperative at the start of the 
August 17 interview but became “increasingly angry” as the questions focused 
on his source of financial support, his reasons for flight training, and his 


103 A sheikh is “a venerable old man, a chief” or “the head of an Arab family, or of a 
clan or tribe; also, the chief magistrate of an Arab village.” 


104 EBI records show that these two names were later checked in ACS, but no 


information was found on them. 
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religious beliefs. He was asked again to explain the source of his income, and 
he offered for the first time that he had received money from friends in the 
United Kingdom and from a friend in Germany for whom he could only recall 
a first name. Henry wrote that questions about materials in Moussaoui’s laptop 
“provoked an extremely strong emotional reaction” in Moussaoui. 


The agents told Moussaoui that they believed that he was an extremist, 
“intent on using his past and future aviation training in furtherance of a terrorist 
goal.” He was asked to provide the name of his group, the religious scholars 
whom they followed, and to describe his plan in detail. Henry reported that 
Moussaoui was “visibly surprised” at the question about his membership in a 
group and that the FBI was aware of his fundamentalist beliefs. Moussaoui 
repeated he was in the United States to enjoy using a simulator for a big plane. 
According to Henry’s 26-page EC, Moussaoui then requested an immigration 
lawyer, and the questioning was therefore halted. 


D. Expedited deportation order 


After the INS arrested Moussaoui on August 16, it initiated the process 
for deporting him. Because he had entered the country under the terms of the 
Visa Waiver Program, he was subject to the “expedited removal” process. As 
a condition of entering the United States under this program, Moussaoui 
waived any right to contest the deportation. For this reason, the deportation 
process consisted of paperwork prepared by an INS official, with no hearing 
before an immigration judge. 


The deportation order for Moussaoui was signed on August 17, 2001. 
Henry told the OIG that he had been informed by the INS agent who had 
conducted the interviews with him that persons who had entered the country 
under the Visa Waiver Program and overstayed were not entitled to an appeal 
and would therefore be deported very quickly. Henry’s supervisor, Gary, said 
that he also had been told by INS officials that Moussaoui could only be held 
for seven to ten days before he would be deported. As a result, the 
Minneapolis FBI believed that Moussaoui’s deportation was imminent. 
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E. Discussion regarding search warrant 


1. Henry’s 26-page EC 


After Moussaoui’s arrest, Henry prepared a 26-page EC that provided a 
lengthy description of the facts of the case. The EC set forth the information 
obtained from the flight school, the information from the two interviews of 
Moussaoui and the two interviews of Al-Attas, and the information obtained 
from the items in Moussaoui and Al-Attas’ possession when they were 
arrested. 


The EC, which was uploaded into ACS on August 20, included some of 
Henry’s assessments of Moussaoui’s and Al-Attas’ behavior. It described 
Moussaoui as “extremely evasive” and “extremely agitated” when asked about 
his religious beliefs, overseas travel and associates, and the source of his 
financial support. Henry also wrote that he believed, based on Moussaoui’s 
demeanor, Moussaoui was being deceptive when he denied any weapons 
training. Henry also wrote that Al-Attas was being “deceptive in trying to 
minimize both his understanding of and involvement in whatever Moussaoui 
was planning to do.” 


Henry concluded the EC by stating, “Minneapolis believes that 
Moussaoui is an Islamic extremist preparing for some future act in furtherance 
of radical fundamentalist goals.” In support of this conclusion, Henry wrote: 


The numerous inconsistencies in his story, his two month 
long trip to Pakistan which ended less than three weeks before 
his coming to the U.S., and his inability to explain his source of 
financial support all give cause to believe he is conspiring to 
commit a terrorist act, especially when this information is 
combined with his extremist views as described by Al-Attas in 
his sworn statement. 


As Moussaoui was in the process of gathering the most 
knowledge and skill possible in order to learn to fly the Boeing 
747-400, Minneapolis believes that his plan involved an aircraft 
of this type. This is especially compelling when considering 
that the 400 series of this aircraft has a smaller flight crew and is 
more automated than other versions, lending itself to simpler 
operation by relative novices. His request of Pan Am that he be 
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permitted to fly a simulated flight from London’s Heathrow 
Airport to New York’s JFK Airport is suggestive and gives 
Minneapolis reason to believe that he may have been attempting 
to simulate a flight under the conditions which he would operate 
while putting his plan into motion in the future. 


Henry wrote that the Minneapolis FBI believed “Moussaoui, Al-Attas 
and others yet unknown [were] conspiring to commit violations of [federal 
anti-terrorism statutes].” Quoting from one of the statutes, Henry wrote that 
Moussaoui and Al-Attas were “attempting or conspiring to destroy or damage 
any structure, conveyance, or other real or personal property within the United 
States.” See 18 U.S.C. § 2332b. In addition, Henry wrote that the Minneapolis 
FBI believed Moussaoui was engaging in flight training for the purpose of 
conspiring to use an airplane in the commission of a terrorist act. In support of 
this, Henry noted Moussaoui’s possession of knives and his preparation 
through physical training for violent confrontation. Henry wrote that 
Moussaoui’s “plan is believed to involve the performance of violence or 
incapacitation of individuals on aircraft.” The EC further stated that 
Minneapolis considered the matter to be urgent. 


At the conclusion of the EC, Henry wrote, “Minneapolis believes that the 
preponderance of information to be gained from future investigation will 
concern the specific criminal acts set forth above. However, as there is reason 
to believe that Moussaoui and Al-Attas are part of a larger international radical 
fundamentalist group, [the intelligence investigation] will remain open and a 
[criminal investigation] will be opened.” 


Through the EC, Henry also sent out several leads, including leads to FBI 
Headquarters, the Paris and London Legats, and the Oklahoma City Field 
Office. In the leads to the London and Paris Legats, Henry requested that they 
provide the EC to the British and French governments and report to 
Minneapolis any information developed on Moussaoui or any of his associates 
“yet unknown.” The lead to the Oklahoma City FBI asked it to fully identify 
all of the individuals from that area who had surfaced in the investigation, 
including a request to further investigate Al-Attas. 


With respect to the lead to FBI Headquarters, Henry requested that FBI 
Headquarters “expeditiously” obtain permission from OIPR for the 
Minneapolis FBI to contact the Minneapolis USAO to discuss the merits of 
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prosecution; to seek a criminal search warrant for Moussaoui’s belongings, 
residences, and vehicles; and to obtain subpoenas for his telephone and 
financial records.'” 


Henry also sent an e-mail to the SSA who we call Jack in FBI 
Headquarters on Sunday, August 19, providing an update on the case. 


Henry wrote that both Moussaoui and Al-Attas were in custody on INS 
violations. Henry reported that the Minneapolis FBI was planning to open a 
criminal investigation on Moussaoui and was seeking permission to contact the 
USAO. Henry explained his desire to obtain a criminal search warrant to 
search Moussaoui’s possessions from the hotel room, including his laptop 
computer, cellular telephone, and other documentary material, and also 
Moussaoui’s property in his residence in Norman, Oklahoma.’ Henry wrote 
that he thought that a search of Moussaoui’s things could “reveal detailed 
information regarding his plans and associates worldwide. He’s obviously 
well-funded and highly motivated.” 


Henry also e-mailed the 26-page EC to Jack the next day, Monday, 
August 20. In the e-mail accompanying the EC, Henry again requested that 
FBI Headquarters obtain permission to allow Minneapolis to contact the 
Minneapolis USAO for a search warrant “as soon as possible.” In the e-mail, 
Henry reported that Al-Attas was being released on bail and was returning to 
Oklahoma, where he could potentially “destroy incriminating evidence.” 
Henry concluded the e-mail by writing, “[p]lease let me know as soon as [the 
Department] gives the go-ahead. We’re all counting on you!” 1 


105 As discussed in Chapter Two, the 1995 Procedures provided that when an 


intelligence investigation was open and no FISA techniques had yet been employed, an FBI 
field office had to obtain permission through FBI Headquarters from the Criminal Division, 
not from OIPR, to contact the local USAO. 


106 According to Henry, the Minneapolis FBI was aware of the requirement that to open 


a criminal investigation Minneapolis had to establish a “wall” between the criminal 
investigation and the intelligence investigation. He said that the Minneapolis FBI had 
planned for Henry to remain the agent for the intelligence investigation and for a different 
agent to handle the criminal investigation. 


107 Tn addition, in an e-mail dated August 21 to FBI Headquarters, Gary, and another 


Minneapolis FBI agent, Henry wrote, “It’s imperative that the [United States Secret Service] 
(continued) 
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2. Assignment of Moussaoui investigation at FBI Headquarters 


According to Jack, he reviewed Henry’s EC on August 20 and noticed 
that Hizbollah was not mentioned. This indicated to Jack that the case did not 
belong in his unit. Rather, because of the lack of information about any 
particular terrorist group and the extremist view described to Moussaoui in the 
EC, Jack believed that the case belonged in the ITOS’ Radical Fundamentalist 
Unit (RFU). Cases that could not be linked to a specific group or substantive 
unit and involved radical extremist allegations are assigned to the RFU. 


That same day Jack discussed the EC with his Unit Chief, who instructed 
him to give the matter to the RFU and walk the EC over to that unit. Jack 
therefore gave the 26-page EC to the RFU Unit Chief who we call “Don.” +° 
Don told the OIG that at the time there were four SSAs in the RFU. Don 
assigned the matter to one of them, an SSA who we call “Martin,” based on the 
availability and workload of the staff at the time. An IOS assigned to work 
with Martin, who we call “Robin,” also was assigned to the Moussaoui case. 
Henry was informed that the investigation had been reassigned to Martin in the 
RFU. 


Martin had joined the FBI in 1988 as a special agent and spent his first 
three and a half years conducting bank fraud and embezzlement investigations 


(continued) 

be apprised of this threat potential indicated by the evidence contained in the EC. If 
[Moussaoui] seizes an aircraft flying from Heathrow to NYC, it will have the fuel on board 
to reach DC.” Henry told the OIG that he believed that the Secret Service, in its role of 
protecting the President, needed to be advised of Moussaoui because he posed a threat to the 
White House. Henry knew that Moussaoui had received training to fly a 747-400 and if 
Moussaoui hijacked an airplane and flew from Heathrow to New York, the airplane would 
have enough fuel to be diverted to Washington. According to Henry, he never got a 
response to this e-mail. 


108 As discussed in Chapter Three, Don had been the Unit Chief of the RFU since May 
2001. He became an FBI agent in 1987 and spent eight years in the Newark Division. 
Between 1990 and 1995, he worked international terrorism matters on the Newark 
counterterrorism squad. In 1995, he was promoted to an SSA position in a unit other than 
the RFU in ITOS in FBI Headquarters. In 1998, he became the supervisor of a 
counterterrorism squad in the Miami Division and remained there until his promotion to the 
Unit Chief of RFU in 2001. 
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in Colorado. In February 1992, he entered a language program at the Defense 
Language Institute in Monterey, California, to study Arabic for more than two 
years. After completing the language course, in September 1994 he became an 
agent on the counterterrorism squad of the Washington Field Office, where he 
worked exclusively on international terrorism matters, including the bombing 
of the Khobar Towers in Saudi Arabia in 1996. In November 1999, Martin 
was promoted to be a Supervisory Special Agent in the RFU. 


IOS Robin began working for the FBI in 1976 in a clerical position. In 
1980, she was promoted to a paralegal specialist position, where she handled 
Freedom of Information Act requests. In 1993, she was promoted to the IOS 
position and assigned to a substantive unit in ITOS. In approximately 1994, 
the RFU was formed, and Robin was assigned to that newly created unit. In 
2001, Robin had responsibility for terrorism matters with a connection to two 
African countries. 


3. Prior relationship between the Minneapolis FBI and RFU 


The Moussaoui matter was not the first time that the Minneapolis FBI 
and the RFU worked together. Unfortunately, the earlier matters resulted in 
disputes and significant friction between the two offices. We believe this past 
history, which we discuss briefly here, affected how the two offices interacted 
on the Moussaoui case. 


Several FBI employees told the OIG that the Minneapolis FBI’s 
counterterrorism squad had conflicts with the RFU that preceded Martin and 
continued after Martin came to the RFU. The RFU Unit Chief who preceded 
Don, who we call “Dan,” told the OIG that the SSA who had been the 
supervisor of the Minneapolis counterterrorism squad until the first week of 
August 2001 — who we call “Charles,” had conflicts with the RFU SSA who 
had preceded Martin and that Dan had helped Charles in dealing with those 
conflicts. Dan added that the Minneapolis FBI counterterrorism squad had a 
reputation for saying “the sky is falling.” 


By contrast, Charles told the OIG that the RFU “raised the bar” for what 
was needed for the Minneapolis FBI to accomplish what it wanted. For 
example, Charles said that Martin had not supported the Minneapolis FBI’s 
recommendation that the FBI seek the designation of a particular organization 
as a terrorist organization by the State Department. Charles said that Martin 
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had forwarded to Don an e-mail exchange between Charles and Martin that 
arose out of this conflict, and that Don e-mailed Charles to say that he wanted 
to discuss the problem. Charles said he spoke to Don about a week after the e- 
mail and that Don told him that he did not have a full complement of SSAs in 
the unit and that Charles had to deal with the personnel that were in the unit. 


Charles also told the OIG that Martin treated Henry like he was a new 
employee. Charles said that, while Henry only had two years of FBI 
experience, he had a significant intelligence background based on his work 
with the Navy. According to Charles, Martin had “a track history of not giving 
[Henry] much respect.” 


Don told the OIG that soon after his arrival as unit chief in June 2001, he 
had a telephone conversation with Charles about the prior conflicts between the 
Minneapolis FBI and the RFU, including conflicts with the SSA who preceded 
Martin, the former unit chief, and Martin. Don stated that Charles told him that 
there had been “personality conflicts” and that he did not believe that the RFU 
had supported the Minneapolis FBI sufficiently. In particular, Don said 
Charles discussed Martin’s lack of support for Minneapolis’ recommendation 
that the FBI attempt to have a particular organization designated as a foreign 
terrorist organization by the State Department. Don told the OIG that he 
advised Charles that he wanted the disputes between the two offices to end and 
that if Charles had a problem with the RFU, he should address it with Don. 


Martin told the OIG that he was aware that there had been prior conflicts 
between Minneapolis and others in the RFU. He said that his understanding 
was that Minneapolis had made some errors in their handling of matters with 
other SSAs, such as initiating electronic surveillance before the FISA order had 
actually been signed. Martin stated that his problems in his dealings with the 
Minneapolis office began when the conflict with Charles arose over the 
designation of an organization as a terrorist organization by the State 
Department. Martin told the OIG that he did not believe that it was appropriate 
to pursue the designation, based on information that he had obtained from the 
FBI’s IOS who had responsibility for the particular organization for the FBI 
and from the CIA program manager who handled the particular organization 
for the CIA. Martin said that Charles believed that Martin was attempting to 
undermine his efforts. Martin believed that Charles also had “tak[en] offense” 
when he pointed out mistakes that were made by Minneapolis, such as failing 
to “minimize” a conversation recorded pursuant to a FISA warrant. 
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Henry told the OIG that he was “unhappy” that the Moussaoui matter had 
been assigned to Martin because of how matters “had gone in the past.” Henry 
said that Martin acted with an “abundance of caution” and cited examples in 
which he believed that Martin had not acted aggressively enough. For 
example, Henry said that Martin refused to allow Minneapolis to pursue a 
criminal investigation in an intelligence investigation in which electronic 
surveillance under FISA was being conducted. According to Henry, without 
the criminal part of the case, the intelligence case could not proceed, and 
Minneapolis wanted to continue both the criminal investigative activity and the 
electronic surveillance. Henry told the OIG that Martin would not allow it. 
According to Henry, Minneapolis was forced to close its investigation, and 
another field office later picked up the criminal case. 


With respect to the specific case cited by Henry, Martin stated that during 
the FISA renewal process he informed OIPR and the FISA Court of the 
criminal direction the case was taking. According to Martin, the Court did not 
have a problem with the case at that point. However, OIPR requested a 
meeting with ITOS Section Chief Michael Rolince to discuss whether there 
was a “primary purpose” problem, and they collectively decided to shut down 
the FISA surveillance. This was conveyed to the Minneapolis FBI, which in 
turn discontinued surveillance on the target. Martin told the OIG that at no 
time did he instruct Minneapolis that the criminal case could not be pursued. 


Robin told the OIG that she believed that part of the problem between 
Martin and the Minneapolis FBI was a difference in style. According to Robin, 
Minneapolis, and field offices in general, usually wanted things done 
immediately. She said, however, that Martin was very “laid back” and that “he 
doesn’t get all riled up and stirred up about things. He just — he’s not a spin- 
through-the-roof kind of guy. But he gets everything done and it’s not that he 
doesn’t do them timely. He just doesn’t get excited about stuff.” 


Former RFU Unit Chief Dan also described the differences between the 
Minneapolis FBI and Martin as a “clash of personalities.” He described Martin 
as “low key” but “professional,” and said that Charles was “more animated.” 
Another IOS in the RFU who worked with the Minneapolis agents and Martin 
also described the problems as a “personality conflict.” He described Martin as 
“methodical” and said that he had an “even keel” approach. He described the 
Minneapolis agents as “aggressive” and said that with every request to FBI 
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Headquarters, their approach was “if this doesn’t happen, the world is going to 
end.” 


4. Gary seeks advice from ASAC Charles 


Gary told the OIG that on August 21 he called ASAC Charles, who was 
in training at Quantico, for guidance on how to proceed, and that Charles told 
him that he should seek a criminal warrant. Charles said that he gave Gary this 
advice since he did not believe the Minneapolis FBI would be able to get a 
FISA warrant, not because of the facts in the Moussaoui case but because of 
his past experience with the difficulty and significant delays in obtaining FISA 
warrants. Charles stated that, in his experience, OIPR only wanted “slam 
dunks.” 


Charles told the OIG that, as part of the training he was attending at 
Quantico at the time, Deputy Attorney General Larry Thompson had just 
recently presented at the training conference a memorandum on the issue of 
intelligence sharing dated August 6 and addressed to the Criminal Division, the 
FBI, and OIPR. As discussed in Chapter Two, this memorandum reiterated the 
requirement of the 1995 Procedures that the Criminal Division be notified 
when there was a “reasonable indication” of a “significant federal crime” and 
that this notification was “mandatory.” The memorandum also stated that 


109 As discussed in Chapter Two, the report of the OIG’s Campaign Finance Report and 


the report of the Attorney General’s Review Team investigating the Wen Ho Lee matter 
concluded that the FBI was not complying with the notification requirement primarily 
because of a fear that any contact with the Criminal Division would negatively affect an 
existing FISA order or the FBI’s ability to obtain one in the future. In January 2000, 
Attorney General Reno established the “Core Group,” which consisted of the FBI’s 
Assistant Directors for counterterrorism and counterintelligence, the Principal Deputy 
Attorney General, and the Counsel for OIPR. The FBI Assistant Directors were supposed to 
provide “critical case briefings” to the Core Group, and they were to decide if the facts of 
the case warranted notification to the Criminal Division as provided for in the 1995 
Procedures. The Core Group was disbanded in October 2000 and reconstituted in April 
2001, but the problem of lack of notification to the Criminal Division remained. In July 
2001, the GAO issued its report recommending, among other things, that the Attorney 
General establish a policy and guidance clarifying the expectations regarding the FBI’s 
notification of the Criminal Division about potential criminal violations arising in 
intelligence investigations. 
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the standard for reasonable indication was “substantially lower” than probable 
cause, but that it required more than “a mere hunch.” Charles told the OIG that 
he explained the new guidelines to Gary and recommended that he bring them 
to the attention of FBI Headquarters. Charles told the OIG he believed that by 
doing this, FBI Headquarters would be forced to contact the Criminal Division, 
and that once this occurred, the Criminal Division would on its own direct the 
Minneapolis FBI to contact the USAO about a search warrant. Gary told the 
OIG that Charles faxed the memorandum to him and that he discussed 
notifying the Criminal Division about Moussaoui with Martin on August 22, 
which we discuss below in Section F. 


Gary also said that Charles told him that if he had any problems in 
dealing with Martin that he should ask Acting SAC Roy to “go up the chain of 
command” in FBI Headquarters, and Charles provided Gary with the names of 
upper management, including Assistant Section Chief Steve Jennings, Section 
Chief Rolince, and Deputy Assistant Director James Caruso. According to 
Gary, Charles suggested that Gary pass these names to Roy because Charles 
did not believe that Roy knew who they were. Gary told the OIG that he 
provided these names to Roy. 


Charles also recommended that the Minneapolis FBI contact an FBI 
employee detailed to the CIA, who we call “Craig,” to request any information 
that the CIA had on Moussaoui. 


5. Henry discusses with Don pursuing criminal warrant 


According to Henry, on approximately August 21, he called RFU Unit 
Chief Don to discuss pursuing a criminal investigation of Moussaoui. Henry 
told the OIG that Gary had already filled out the paperwork for opening a 
criminal terrorism investigation, and Henry was calling Don to let him know 
that the paperwork would soon be submitted to FBI Headquarters. 


Henry told the OIG that Don instructed him that he could not pursue the 
criminal investigation. Henry stated that Don said to him, “You will not open 
it, you will not open a criminal case.” Henry stated that Don asserted that if the 
Minneapolis FBI attempted some kind of criminal process from the USAO, 
such as a Search warrant, and failed, it would not thereafter be able to pursue a 
FISA warrant. According to Henry, Don also asserted that probable cause for a 
criminal search warrant was “shaky.” 
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Although Henry believed there was probable cause for a criminal 
warrant, he said that as an entry-level agent he was not in a position to argue 
with Don, a unit chief at FBI Headquarters, who was in a better position to 
judge how the FISA Court would respond to a FISA request that followed a 
failed attempt to obtain a criminal search warrant. Henry said that although his 
supervisor, Gary, had previously prepared paperwork for opening the criminal 
investigation, Henry wrote, “Not opened per instructions of [Unit Chief Don]” 
on it after this conversation with Don. 


Don’s recollection of the conversation with Henry about pursuing a 
criminal investigation of Moussaoui differed from Henry’s. Don told the OIG 
that his recollection was that he talked to the Acting Minneapolis ASAC, 
Charles, and that he did not speak to Henry. Charles told the OIG, however, 
that he did not speak to Don before September 11. We believe that Don likely 
spoke to Henry, not Charles. 


Don told the OIG that, based on his knowledge of the case, he did not 
believe there was criminal predication for a criminal search warrant. Don 
stated that, in his opinion, Minneapolis had a “belief” that there was the 
potential for a criminal charge of conspiracy to hijack, but this was not 
supported by sufficient evidence. Don also asserted that since Moussaoui had 
been arrested and detained on immigration charges, he could not be involved in 
a crime that was about to be committed. 


According to Don, he voiced his opinion to the Minneapolis FBI about 
the lack of criminal predication and advised that if obtaining the criminal 
warrant failed, the FBI would not be able to pursue the FISA warrant. Don 
told the OIG he expressed in the conversation that he did not want Minneapolis 
to follow the criminal road prematurely. However, Don asserted that at no 
time did he tell the Minneapolis FBI that it could not pursue the matter 
criminally. 


Don also stated to the OIG that he advised the Minneapolis FBI to 
consult with the Minneapolis CDC about whether probable cause for a criminal 
search warrant was present. According to Don, he stated, “You guys need to 
go back to your CDC, you need to discuss it with your CDC, and get back to 
me and tell me your position.” Don told the OIG that, in his opinion, giving 
this kind of advice — whether there was criminal probable cause — was the role 
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of the CDC. He said he wanted the Minneapolis CDC to weigh in before the 
Minneapolis FBI made its decision about which way to proceed. 


Henry confirmed to the OIG that Don advised him that he should consult 
with his CDC on the matter. After his conversation with Don, Henry met with 
Rowley to discuss whether Minneapolis should pursue the criminal 
investigation. 


Martin told the OIG that his understanding was that Don explained to the 
Minneapolis FBI the problems that could arise when a criminal investigation is 
pursued at the same time that a FISA warrant has been issued or is being 
sought. Martin said he thought that Don had told the Minneapolis FBI, “You 
guys need to be careful. You need to run it through your division counsel if 
you want to do a criminal investigation on this guy, because if you do that and 
you get turned down by a magistrate or even if you try to get the okay from a 
U.S. Attorney’s Office, we have to document that in our request to the FISA 
court, and we risk making it look like to the judge that we really want to get a 
criminal case, want to prosecute the guy but we didn’t have enough probable 
cause to get a criminal search warrant.” Martin told the OIG that it was his 
understanding that Minneapolis “listened to [Don] and agreed.” 


6. CDC Rowley’s recommendation 


According to Rowley, Henry came to her office some time after his 
conversation with FBI Headquarters and conferred with her about whether to 
seek a criminal search warrant in the Moussaoui case. Rowley said this 
occurred on or about August 22. Rowley told the OIG that, until this point, she 
had not been actively involved in the Moussaoui investigation, although she 
had had a brief discussion with Gary on the night of Moussaoui’s arrest. 


As discussed above, Rowley was the CDC for the Minneapolis FBI. She 
had graduated from law school in May 1980 and joined the FBI as a special 
agent in January 1981. After working in several FBI offices on, among other 
cases, white-collar crime, drug investigations, and applicant background 
investigations, Rowley transferred to the Minneapolis FBI office in July 1990. 
Rowley said that as the CDC for the Minneapolis FBI, she spent very little of 
her time on intelligence matters. She stated that she had attended FBI training 
on counterterrorism issues, including FISA, but that she usually was not 
involved in the FISA process. She said that agents typically dealt with FBI 
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Headquarters on these matters and that she had only reviewed a couple of FISA 
requests. 


Rowley told the OIG that when Henry came to her office around 
August 22, he asked her what she thought about the FISA issue in the 
Moussaoui case. He related that he had spoken to either Martin or Don 
(Rowley did not recall which one), who had suggested that the Minneapolis 
FBI would have a better chance of obtaining a warrant if it sought a FISA as 
opposed to a criminal search warrant. She said she thought Henry may have 
mentioned something about the “smell test.” She said that, after discussing the 
matter with Henry, like the RFU she recommended going the FISA route 
because of the “smell test.” Rowley explained that she knew that if a FISA 
warrant was sought after an unsuccessful attempt to obtain a criminal warrant, 
it would give the appearance — or “smell” — that the true purpose for seeking 
the FISA was for criminal prosecution and the FISA warrant would be denied. 
According to Rowley, Henry’s position was that the Minneapolis FBI should 
proceed with the criminal search warrant and not worry about the smell test. 
Rowley, however, stated that the smell test was a reality and advised that it had 
to be factored into the decision. 


Additionally, Rowley said that while she thought that there was probable 
cause for a criminal search warrant, she also believed that the USAO in 
Minneapolis required a higher standard than probable cause to seek a search 
warrant." Because of the smell test and concerns whether the USAO would 


110 Th her May 21, 2002, letter to the FBI Director, Rowley stated that she had advised 
Henry to seek the FISA warrant instead of the criminal warrant because the Minneapolis 
USAO “regularly requir[ed] much more than probable cause” and “requir[ed] an excessively 
high standard of probable cause.” In the letter, Rowley gave as an example of this the 
Minneapolis FBI’s investigation of mailbox pipe bombings during which, she wrote, an 
AUSA declined permission to seek a search warrant despite “significant evidence” 
supporting the search warrant. We interviewed several attorneys in the Minneapolis USAO, 
including the United States Attorney, Thomas Heffelfinger. All the attorneys denied that the 
Minneapolis USAO required more than probable cause before seeking search warrants. 
They also stated that in cases in which the USAO determined that there was insufficient 
evidence to support a search warrant, their practice was to specify the FBI’s options, 
including what additional information was needed to support probable cause. With respect 
to the mailbox pipe bombings case, Heffelfinger acknowledged that there had been a 
disagreement between the USAO and the FBI over whether sufficient evidence existed to 
(continued) 
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agree to a criminal search warrant, Rowley said that she recommended the 
avenue with the best chance of success, which she believed was seeking a 
FISA warrant instead of a criminal warrant. 


Rowley told the OIG that at the time of her discussion with Henry she 
had not discussed the Moussaoui matter with any attorneys in the National 
Security Law Unit (NSLU) or anyone else in FBI Headquarters.''' She also 
said that she had not reviewed the FISA statute or any other training materials 
about FISA warrants. She said her advice was based on her knowledge of the 
problems with the smell test, the problems with the Minneapolis USAO, and 
“optimizing” the chances of getting a warrant by pursuing the FISA process 
first. 


Henry confirmed to us that Rowley recommended that pursuing the FISA 
warrant would be the safest route. When we asked Rowley about the nature of 
the discussion that she had with Henry about seeking the criminal warrant, 
Rowley told the OIG that she was “helping make his decision.” When we 
asked Rowley whose decision it was to not seek the criminal warrant — the field 
office or Headquarters — she stated: 


I thought it was kind of, I don’t know, kind of a joint thing. I 
thought Headquarters, somebody at Headquarters had also 
recommended we try FISA first, too. But I think maybe 
ultimately it was [Henry]’s decision to try FISA first or our field 
division’s. 


F. The FISA request 


As aresult, the Minneapolis FBI began seeking a FISA warrant, instead 
of a criminal warrant, to search Moussaoui’s belongings that were being held 
by the INS. 


(continued) 
obtain a search warrant, but he stated that the FBI declined to pursue the additional 
investigative steps suggested by the USAO. 


11 Rowley’s only contact with anyone at FBI Headquarters about the Moussaoui matter 


was in a brief e-mail exchange with an NSLU attorney, which we discuss in Section F, 4, d 
below. 


132 


1. Minneapolis seeks to expedite the FISA process 


When Gary first discussed seeking a FISA search warrant for 
Moussaoui’s belongings with Martin on August 22, Gary indicated that 
Minneapolis wanted to expedite the process. As noted above, Gary told the 
OIG that the Minneapolis FBI had been informed by INS officials that the INS 
could only hold Moussaoui for seven to ten days before deporting him. Gary 
said that he was aware that FISA requests normally took a long time and that 
the Minneapolis FBI was concerned about expediting the process to ensure that 
the FISA warrant was obtained and executed before Moussaoui’s deportation. 
Gary said that he explained to Martin that the INS said it could only hold 
Moussaoui for seven to ten days. 


Martin told the OIG that he recalled that the Minneapolis FBI was very 
concerned about obtaining the FISA warrant quickly before the INS deported 
Moussaoui. Martin said he explained to Gary that a way to expedite the 
process would be to seek an emergency FISA. He also explained the process at 
FBI Headquarters for obtaining an emergency FISA, including the requirement 
for ITOS Section Chief approval." 


Gary and Henry began preparing a FISA request while they continued the 
investigation of Moussaoui. 


2. The RFU’s assessment of the Minneapolis FBI’s FISA 
request 


At FBI Headquarters, Martin and Robin began looking into the merits of 
the Minneapolis FBI’s FISA request, based on the information about 
Moussaoui that the Minneapolis FBI had provided, primarily in the 26-page EC 
Henry had sent to FBI Headquarters about the Moussaoui investigation. 


Martin told the OIG that his reaction upon reading the 26-page EC with 
respect to obtaining a FISA warrant was that while he believed Moussaoui was 
“a dirty bird” and was probably “up to something,” there was no evidence 


112 As discussed in Chapter Two, although the term “emergency FISA” was used, it 


referred to obtaining an expedited FISA warrant and not the statutory emergency FISA that 
involves a warrantless search approved by the Attorney General without prior approval of 
the FISA Court. 
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linking Moussaoui to a foreign power of any kind. Martin said that based upon 
what was in the EC, his opinion was that “there was no way” that a FISA 
warrant could be obtained because of the lack of evidence linking Moussaoui 
to a foreign power. 


Robin told the OIG that Martin informed her that Minneapolis was 
seeking a FISA search warrant and Martin provided her with a copy of the 
26-page EC to read. She said that after reading the EC, she also believed that 
Moussaoui was “up to something.” However, she said that after reading the 
EC she asked Martin, “Where’s the foreign power?” In her view there was no 
evidence of a terrorist organization’s involvement with Moussaoui. According 
to Robin, Martin agreed with her assessment that the FISA request lacked a 
connection to a foreign power. 


3. Additional information related to Moussaoui 


The Minneapolis FBI continued to collect additional information about 
persons associated with Al-Attas in connection with the posting of his bond for 
release from the INS detention facility. In an EC written by Henry and dated 
August 22, the Minneapolis FBI reported to FBI Headquarters that Al-Attas 
had been bonded out of custody on August 20. While he was still in custody, 
he made 13 calls to a telephone number registered to a man who had been 
identified in an earlier interview by Al-Attas as the imam — or leader, 
spokesman, and advisor — of the mosque attended by Al-Attas in Norman, 
Oklahoma. We will call this person “Ahmed.” Al-Attas told the Minneapolis 
agents that he had called Ahmed to request assistance in raising bond money. 


The Minneapolis FBI conducted name checks for Ahmed in FBI 
databases and learned that a person with the same name was the suspect in 
several bank robbery investigations in Memphis, Tennessee, but that he had not 
been in contact with the FBI since 1999. The Minneapolis FBI sought to 
determine if the Ahmed who talked to Al-Attas was the same person as the 
bank robbery suspect. The Oklahoma City Field Office informed the 
Minneapolis FBI on September 6 that it had determined that the Ahmed who 
was the assistant iman of the Norman mosque was not the same Ahmed who 
was the bank robbery suspect in Memphis. 


The Minneapolis FBI also determined that two other men were involved 
in attempting to post Al-Attas’ bond. The first was a man who we will call 
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“James Smith,” who had gone to the INS offices in Oklahoma City to inquire 
about Al-Attas’ bond. Smith was the imam of a local mosque. The 
Minneapolis FBI reported that he was the subject of an Oklahoma intelligence 
investigation, but it did not state the date, status, or findings of the investigation 
on Smith." 


In addition to Smith, the Minneapolis FBI learned that an individual, who 
we call “Mohammed Mohald,” had gone to the INS District Office near 
Minneapolis and paid Al-Attas’ bond on August 20.''* According to 
documents prepared in the case, Mohald had reported to INS officials that he 
was and had been Al-Attas’ roommate for some time, and that he knew Attas’ 
traveling companion — whom he called “Shaqir” — because they attended the 
same mosque in Norman, Oklahoma, where they all lived. Mohald advised 
that he had been a Muslim since 1970 and had traveled to a Middle Eastern 
country in the late 1980s as part of a missionary group.'” The EC stated that a 
search in ACS revealed that Mohald had an extensive criminal history and was 
the subject of a New York criminal terrorism-related investigation. The EC did 
not state the date, status, or findings of the investigation. 


In the EC, Henry reported suspicions about Mohald and stated that he 
believed that Mohald was involved in Moussaoui’s plan to commit a terrorist 
act along with Al-Attas. Henry’s suspicions were based on inconsistencies 
such as Mohald stating that he was Al-Attas’ roommate, when the Minneapolis 
FBI had confirmed that Al-Attas had been living for approximately one month 
with Moussaoui and someone else at an address other than the one provided by 


113 The Oklahoma City Field Office reported in an EC dated August 24 that Al-Attas had 
spoken not only to Smith but also to an individual who we will call “Nabu Khalid,” who was 
the assistant imam to Smith. The Oklahoma City FBI reported that Smith and Khalid were 
the subjects of preliminary inquiries for their suspected involvement in a terrorist cell. This 
terrorist cell was not linked to Al Qaeda. 


114 This individual was American-born but had adopted a Muslim name. 


115 This particular missionary group is a worldwide Islamic missionary organization 


which was founded several decades ago. As discussed below, some members of this 
missionary group used the organization as a means and as a cover to recruit individuals to 
conduct acts of terrorism and to send them to Middle Eastern countries under the guise of 
“religious training.” 


135 


Mohald. In addition, while Mohald admitted to traveling to a Middle Eastern 
country in the late 1980s, ACS records showed that he was issued a visa for 
that country in April 1990 under his American name, which suggested that 
Mohald withheld information from the FBI about later trips to this Middle 
Eastern country. Henry also found Mohald’s explanation that he had flown to 
Minneapolis to post Al-Attas’ bond so that Al-Attas could return to teach 
children at the mosque in Oklahoma to be “farfetched.” ° 


Around the same time, Henry sent an e-mail to other FBI agents involved 
in the investigation asking whether he should consider getting assistance from an 
FBI psychological profiler. He wrote, “They probably have a psych profile for 
an Islamic Martyr and could tell us if our 747 guys fit.” According to Henry, he 
contacted an FBI field profiler in Tampa, Florida, whom Henry had met at a 
training session. Henry told the OIG that he contacted this agent because he 
knew him and because this agent was an experienced international terrorism 
investigator. 


Henry told us that this agent provided good re-interview techniques and 
highlighted potential issues based on the information Henry gave him. For 
example, the agent called attention to the fact that while Al-Attas was in jail, 
“the one call [Al-Attas] made was back to the mosque” and not to any family 
member. Henry said that while Al-Attas’ parents lived in Saudi Arabia, Al- 
Attas had at least one cousin and possibly two in the United States but did not 
call these relatives. 


4. Consultations with NSLU attorney Howard 


Also on August 22, at FBI Headquarters SSAs Jack and Martin each 
independently consulted with an NSLU attorney who we call “Howard” about 
the Moussaoui matter. Martin also consulted with three other NSLU attorneys. 
We summarize first the role of NSLU attorneys, specifically with respect to 
FISA requests, before discussing the consultations between Jack and Howard, 
and between Martin and Howard. 


16 Henry provided the names of Ahmed, Smith, and Mohald and their available 


identifying information to the CIA for checks against CIA records. The CIA did not report 
any information about these individuals to the FBI. 
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a. Role of NSLU attorneys 


The NSLU is part of the FBI’s Office of General Counsel in FBI 
Headquarters. The NSLU provided advice to FBI Headquarters and field 
offices on counterterrorism and counterintelligence matters. At the time of the 
Moussaoui case, two NSLU attorneys — who we call “Susan” and “Tim” — 
were assigned to work with ITOS substantive units. Other NSLU attorneys, 
including Howard, were consulted by ITOS employees when Susan and Tim 
were not available.” Marion “Spike” Bowman was the FBI’s Deputy General 
Counsel for National Security Affairs and the head of the NSLU. 


As discussed in Chapter Two, attorneys in the NSLU described their role 
as giving legal advice to their “client,” the substantive unit in ITOS that was 
seeking the advice, but they said it was up to the substantive unit to decide how 
to proceed. NSLU attorneys spent a large amount of time handling questions 
related to FISA, including requests for warrants, execution of FISA orders, and 
dissemination of the information collected pursuant to FISA. 


NSLU attorneys usually were consulted when a question arose whether 
there was sufficient information to support the FISA request. However, NSLU 
attorneys were not “assigned” to work on a particular FISA request or to work 
with specific SSAs. The consultations with NSLU attorneys typically 
consisted of oral briefings by the SSA and the IOS who were handling the 
particular FISA request. In connection with these consultations, NSLU 
attorneys did not normally receive and review the documents prepared by the 
field office or initial drafts of the LHM prepared by the SSA and IOS. Tim 
told the OIG that SSAs would sometimes come back to the NSLU attorney 
with documents to read after an oral briefing when the SSA “was really serious 
about something.” 


After questioning the SSA and IOS, and based on the information 
provided by the SSA and the IOS, the NSLU attorney typically would provide 
verbal guidance about what was needed to support the FISA request. Howard 
told the OIG that his role was “steering [the FBI] through the land mines and 


u7 Howard told the OIG that he primarily worked counterintelligence matters but also 


handled counterterrorism matters as needed. According to Howard, it was not uncommon 
for him to be consulted when Tim and Susan were unavailable. 
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helping them enhance their cases.” Field offices did not normally participate in 
these consultations with the NSLU attorneys. 


Both NSLU attorneys and SSAs described the volume of their work as 
overwhelming. Tim stressed that the NSLU attorneys relied on the SSAs and 
IOSs for their substantive knowledge about the available intelligence on the 
FBI’s targets and terrorist organizations, and that given limited staffing NLSU 
attorneys normally were unable to conduct independent research on the 
substantive issues. 


b. Jack’s consultation with Howard 


As noted above, the Minneapolis FBI’s first contact with FBI 
Headquarters was with SSA Jack. On August 21, Jack made an appointment 
with NSLU attorney Howard to discuss the Moussaoui matter the following 
morning. Jack said that even though the case was in the process of being 
reassigned to Martin in the RFU, Jack kept his appointment with Howard 
because he was “curious” and wanted to discuss the Minneapolis FBI’s options 
for obtaining authority to search Moussaoui’s laptop and other belongings. 


During the meeting on August 22, Jack orally briefed Howard on the 
facts, as reported in Henry’s EC. Jack did not provide Howard with a copy of 
the EC. According to Howard’s notes from the meeting, they discussed 
whether there was sufficient information to obtain either a criminal search 
warrant or a FISA search warrant. With respect to the FISA warrant, Howard 
told the OIG that he advised Jack that he did not believe that there was 
sufficient information to obtain a FISA warrant, primarily because Minneapolis 
lacked the necessary information to articulate a foreign power. Howard’s notes 
indicate that he advised Jack that obtaining the FISA warrant also would be 
difficult because Moussaoui was already in custody. Howard told the OIG that 
at the time, OIPR viewed anyone in custody as a target of criminal 
investigation by the FBI, even if the person was being held on administrative 
charges, and therefore OIPR would question whether the FBI’s “primary 
purpose” was to collect intelligence information. 


With respect to approaching the USAO to obtain a criminal warrant, 
Howard’s notes reflect that he did not believe that there was sufficient 
information to obtain a criminal search warrant. His notes state that he advised 
Jack that a decision needed to be made quickly and that if the Minneapolis FBI 
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decided to pursue the criminal case, then it would be difficult to later pursue 
the FISA warrant. Howard told the OIG, however, that whether to pursue the 
FISA warrant or the criminal warrant was a “judgment call” for Minneapolis to 
make and that he considered the matter to be a “work in progress.” 


Jack confirmed that he received this advice from Howard. He told the 
OIG that Howard advised him that he did not see evidence of a foreign power 
and that Howard concurred that there was no evidence of a criminal act. Jack 
told the OIG that he and Howard were “brainstorming” about the possible ways 
to proceed. Howard’s notes indicate that he told Jack that it looked as if 
Minneapolis had several “good leads” and that Minneapolis needed to follow 
up on those leads. 


c. Martin’s meeting with Howard 


As noted above, on August 20 the Moussaoui case was transferred from 
Joseph to the RFU and assigned to Martin and Robin. On approximately 
August 22, Martin and Robin consulted with Howard for legal advice on 
Minneapolis’ chances for obtaining a FISA warrant.'" 


Martin said that when he began explaining to Howard the facts of the 
Moussaoui matter, Howard said that he was aware of the matter already 
because he had recently been consulted by Jack. According to Martin, Howard 
pulled out notes from his conversation with Jack and began reading them back 
to him and Robin. 


Howard said he remembered having a “brief conversation” with Martin. 
Howard said that he recalled that he was on his way to a meeting and did not 
have time to discuss the issue in detail at that time. He said that he asked 
Martin if the Minneapolis FBI had followed up on specific items, and Martin 
indicated that he did not believe so. Howard reiterated the same advice to 
Martin as he told Jack — that he did not believe that there was sufficient 
evidence to tie Moussaoui to a foreign power and therefore a FISA warrant was 
not possible absent further investigation by Minneapolis. 


118 Martin told the OIG that Tim and Susan, the two NSLU attorneys who usually 


worked on ITOS matters full time, must have been unavailable at the time. 
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Martin told the OIG that he recalled Howard advising him that there was 
not sufficient evidence to support a link to a foreign power. Like Jack, Martin 
did not provide Howard with a copy of the 26-page EC, although Martin had 
the document with him. 


d. Howard’s e-mail exchange with Rowley 


After his meeting with Martin and Robin, Howard sent an e-mail dated 
August 22 to Minneapolis CDC Rowley. In the e-mail, he asked whether she 
had been asked for her “assessment of [Minneapolis’] chances of getting a 
[criminal] warrant” for Moussaoui’s computer. Howard told the OIG that he 
did this because he wanted to make sure that the CDC was “engaged in the 
thought process.” He stated that the decision on which type of warrant to seek 
was the field office’s decision, and he wanted to make sure that the CDC was 
“part of the process.” 


In an e-mail response later the same day, Rowley wrote, “Although I 
think there’s a decent chance of being able to get a judge to sign a criminal 
search warrant, our USAO seems to have an even higher standard much of the 
time, so rather than risk it, I advised that they should try the other route.” 
Rowley told the OIG that in retrospect she wished that she had made it clear in 
her e-mail that she believed that, in fact, there was sufficient evidence to 
support probable cause for a criminal warrant. 


Howard told the OIG that he recalled having the following reaction to 
Rowley’s e-mail: “Good Lord, Coleen, we don’t use FISA because we don’t 
have probable cause for a criminal warrant. That plays right into the hands of 
those people who think FISA is subterfuge.” Howard did not respond to the 
e-mail, nor did he and Rowley discuss the matter on the telephone. 


5. French information about Moussaoui 


Around the same time that Martin consulted with Howard, the 
Minneapolis FBI obtained additional information about Moussaoui from the 
French government. As noted above, because Moussaoui had entered the 
United States with a French passport, Henry had sent a lead to the FBI’s Paris 
Legat to obtain any relevant information on Moussaoui from the French 
authorities. On August 22, the FBI’s Paris Legat reported to the Minneapolis 
FBI and FBI Headquarters that the French government had reported that 
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Moussaoui was purportedly associated with a man who was born in France and 
died in 2000 in Chechnya fighting with “the Mujahideen.” We call this person 
“Amnay.”! The Legat’s EC stated that while in Chechnya, Amnay worked 
for Emir Al-Khattab Ibn (Ibn Khattab), the leader of a group of Chechen 
rebels. According to the EC, the French authorities, after Amnay’s death, 
had interviewed a person who we call “Tufitri” who had known Amnay. 
That person stated that Amnay was recruited to go to Chechnya by Moussaoui 
and that Moussaoui was “the dangerous one.” 


6. Martin advises Minneapolis FBI that French information is 
not sufficient to connect Moussaoui to a foreign power 


After Martin received and reviewed the French information, he still did 
not believe there was sufficient information to identify a foreign power in the 
Minneapolis FISA request. Martin discussed the French information with Gary 
and stated that it provided little help to Minneapolis in connecting Moussaoui 
to a foreign power. Martin explained that Ibn Khattab and the Chechen rebel 
group he led were not an identified terrorist organization. Gary’s notes of the 
conversation indicate that Martin explained that Minneapolis needed evidence 
linking Moussaoui to a “recognized” foreign power. 


Martin told the OIG that by “recognized” he meant a foreign power that 
previously had been pled before the FISA Court. Martin told the OIG that he 
believed that the Chechen rebels had never previously been pled to the FISA 


119 We do not use Amnay’s real name because the FBI considers that information to be 


classified. 


120 As discussed in Chapter Three, after the collapse of the Soviet Union in 1991, 


Chechen separatists — both Islamic and non-Islamic — have sought independence for 
Chechnya from Russia. The Russian army has fought two guerilla wars in Chechnya to 
prevent its independence, resulting in tens of thousands of Chechens and Russians killed or 
wounded. In many Islamic countries, support for the Chechen cause is widespread. Ibn 
Khattab was a Jordanian-born Islamic extremist and leader of a large group of Chechen 
rebels that had many successes in clashes with Russian forces. He was killed in April 2002. 


121 We do not use Tufitri’s real name because the FBI considers that information to be 


classified. 
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Court as a foreign power.'” Rather, Martin described the situation in 
Chechnya as dissidents engaged in a “civil war.” He acknowledged, however, 
that it may have been possible to develop the intelligence to support the 
position that Khattab’s Chechen rebels were a terrorist group. But he said that 


he was not aware of any insurgency/rebel group ever being pled as a foreign 


power. 


In addition, Martin stated that even if the Intelligence Community had 
developed the intelligence that Khattab’s Chechen rebels were a terrorist 
organization and could therefore constitute a foreign power under FISA, this 
could not be completed in a short time, which was what the FBI believed at the 
time was necessary in the Moussaoui case. Martin said he therefore advised 
the Minneapolis FBI that, to obtain a FISA warrant, it needed to develop 
information linking Moussaoui to a recognized or previously-pled, identifiable 
foreign power. '~* 


122 We found that at the time FBI Headquarters was operating under a perception that 


OIPR was overly conservative in its approach to the FBI’s FISA applications because 
OIPR’s standard for probable cause was too high and because OIPR was not interested in 
pleading “new” foreign powers — foreign powers that had not previously been pled to the 
FISA Court. We discuss this perception of OIPR’s conservatism and how it affected FBI 
Headquarters’ handling of the Moussaoui investigation in the analysis section below. 


123 Martin suggested to the OIG that the reason that groups engaged in a civil war were 


not pled as terrorist organizations under FISA was because they were not “hostile” to the 
United States or working against U.S. interests. When asked whether it was a requirement 
under FISA for a terrorist organization to be hostile to U.S. interests to fulfill the foreign 
power requirement, Martin said that he did not know whether this was a legal requirement, 
but that he believed that it was assumed in the statute based on the terrorist organizations 
that had been pursued by the government. 


124 Martin told the OIG that at that time he had had only one other case in which he 


advised a field office that it was not going to be able to obtain a FISA warrant. He said that 
the field office wanted to pursue a FISA warrant targeted at an organization that it believed 
to be a terrorist organization that constituted a foreign power. As discussed above, a foreign 
power or an agent of a foreign power may be the target of a FISA warrant. Martin said that 
this potential target had never before been pled as a foreign power. He said that he 
consulted with an NSLU attorney, who informed him of the intelligence information that the 
field office would have to establish in order to successfully obtain a FISA warrant with the 
organization listed as a foreign power. Martin stated that he informed the field office of this 
(continued) 
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Robin also told the OIG that she did not believe that the French 
information was sufficient to connect Moussaoui to a foreign power. She said 
that she understood that the Chechen rebels had never been pled as a foreign 
power to the FISA Court and that the Intelligence Community had never 
developed sufficient intelligence that the conflict in Chechnya was more than a 
civil war. In one case she was familiar with, she understood that the FBI had 
previously attempted to obtain a FISA warrant using Khattab and the Chechen 
rebels as the foreign power but that it was “turned down” by OIPR.'* She 
stated that “building a foreign power” was “not an overnight thing” and would 
have required months to collect the required intelligence information, as had 
been the case when one particular terrorist group was first put forth as a foreign 
power. 


Gary told the OIG that during the conversation between him and Martin 
on August 22 about the French information, he raised with Martin the issue of 
the mandatory notification of the Criminal Division when there was a 
reasonable indication of a crime, as set forth in Deputy Attorney General 
Thompson’s August 6 memorandum, which Charles had faxed to Gary. 
According to Gary, Martin said that he did not see any evidence of a federal 
felony, that the FISA route was easier, and that going the criminal route first 
would be relevant to whether they were able to obtain a FISA warrant. Gary’s 
notes indicate that Martin stated, “Don’t see federal crime.” Gary told the OIG 
he deferred to Martin but faxed him a copy of the Thompson memorandum. 


(continued) 
advice, and the field office did not insist that the information it had was sufficient for a FISA 
warrant. 


1235 Robin was mistaken about that FISA. The FISA request for that target was initially 


drafted by an FBI field office for a terrorist organization that was based in Northern Africa. 
The target was a well-known leader of a worldwide charitable organization that was known 
for providing financing to Muslim causes around the world, including but not limited to Ibn 
Khattab. The FISA request was given to an analyst in FBI Headquarters, who was asked to 
prepare the FISA request using a different foreign power than the terrorist organization 
based in Northern Africa. Several months later, after the field office developed information 
linking the target directly to a particular terrorist group leader, the analyst prepared a FISA 
request using his group as the foreign power. 
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Martin told the OIG that he did not remember a specific conversation 
with Gary about whether there was probable cause to obtain a search warrant. 
However, he said that he recalled a conversation in which he asked Gary, 
“What would the crime be?” Martin told the OIG he believed that the 
Minneapolis FBI did not have any evidence of a crime and only had “gut 
feelings.” 


7. Robin’s research to link Moussaoui to recognized foreign 
power or terrorist organization 


Robin conducted additional research on Moussaoui to try to bolster 
Moussaoui’s connection to a recognized foreign power. Robin sought to find a 
direct link between Moussaoui or any of the other names or organizations that 
had surfaced in the investigation and foreign powers that she was aware had 
previously been pled to the FISA Court. 


According to Robin, the Moussaoui FISA request was different from the 
typical FISA request because the Minneapolis FBI had not conducted a lengthy 
investigation on Moussaoui before he was arrested. As a result, Robin said, the 
FBI lacked information about Moussaoui that would have been gathered if the 
FBI had conducted physical surveillance and trash covers and obtained phone 
records and financial records, which was how intelligence investigations 
typically proceeded before a FISA warrant was requested.'*° Moreover, 
Minneapolis was seeking an emergency FISA warrant, which meant that there 
was little time to develop more information to support the FISA request. 


Robin ran the names of Moussaoui, Al-Attas, and the individuals who 
had been identified as connected to Al-Attas in ACS and another computer 
system that contained intelligence reports from throughout the intelligence 


126 Financial and telephone records could be obtained, prior to a FISA, through the use 
of a National Security Letter (NSL), which did not require approval of a court before 
issuance by the FBI. At the time of the Moussaoui investigation, the process for obtaining 
NSLs, which involved the signatures of several officials at FBI Headquarters and in the 
NSLU, took several months. Delay in obtaining NSLs has long been identified as a 
significant problem in counterintelligence and counterterrorism investigations. Under the 
Patriot Act, the FBI was given authority to delegate authority for obtaining NSLs to the field 
to speed up the process. 
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community. She said she did not find any evidence linking any of these 
individuals to a foreign power. She said she also researched the missionary 
group that Mohald had said that he had been a part of to determine whether that 
organization had any connections to terrorism or had formed the basis for the 
connection to a foreign power in any previous FISA application. According to 
Robin, it was not until several months after September 11 that individual 
members of this missionary group were pled as targets of a FISA application 
and were described as facilitators and recruiters for a particular terrorist 
organization.” 


In addition, Robin researched the name Ibn Khattab, the Chechen rebel 
leader. Robin said she was not attempting to find information to support using 
Khattab and his rebel group as the foreign power because, according to Robin, 
there was insufficient intelligence to link his group to anything more than a 
civil war. She said that she was aware of a recent FISA application in which 
the subject had strong ties to Ibn Khattab, but that the Chechen rebels were not 
pled as the foreign power in that case. Robin told the OIG that she researched 
Ibn Khattab to determine whether he had close ties to other terrorist groups that 
had previously been pled as foreign powers before the FISA Court, but she did 
not find any. Robin said that she was aware that the FBI’s Washington Field 
Office had an open investigation of Khattab but that it was not an active 
investigation. 


One of the documents that Robin retrieved in her search using the name 
Ibn Khattab was the Phoenix EC, which we described in Chapter Three of this 
report. The author of the EC, Special Agent Kenneth Williams, mentioned Ibn 
Khattab when describing his interview of the subject of an FBI investigation 
who had a picture of Khattab and a picture of Usama Bin Laden on the wall of 
his apartment where the interview was conducted. Williams stated his belief 
that there were an “inordinate number” of persons of interest to the FBI who 
also were receiving training in aviation-related fields of study and that there 


127 Even prior to the September 11 attacks, however, there was intelligence information 


showing that some members of this missionary group were using the organization as a 
means and as a cover to recruit individuals to conduct acts of terrorism and to send them to 
two Middle Eastern countries under the guise of “religious training.” 
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was a possibility that Bin Laden was coordinating an effort to train people in 
the U.S. in order to conduct terrorist activity in the future.” 


ACS records show that Robin printed the Phoenix EC on August 22. 
Robin told the OIG that her usual practice was to read the documents that she 
printed, but she said she did not have a recollection of reading the Phoenix EC 
at the time. 


Robin did not provide the EC to anyone else or discuss its contents with 
anyone, including Martin or the Minneapolis FBI. Robin told the OIG that 
when she read the Phoenix EC after the Joint Intelligence Committee Inquiry 
staff informed her that ACS showed that she had printed the EC, she concluded 
that nothing in the EC would have bolstered Moussaoui’s connection to a 
foreign power for FISA. She also asserted that the Phoenix EC’s reporting of 
information about individuals who were of interest to the FBI — that they were 
Middle Eastern and were in flight school — was not significant at the time 
because there were thousands of Middle Eastern men in U.S. flight schools at 
the time. 


8. Martin and Robin consult with NSLU attorney Tim 


Around August 23, Don directed Martin and Robin to consult with 
another NSLU attorney, Tim, about the Moussaoui case. According to Martin, 
Don thought that Tim should be consulted because he handled counterterrorism 
matters full time and therefore may have had more expertise than Howard. 


Martin orally briefed Tim on the facts of the Moussaoui case but did not 
provide him with any of the documentation. None of the participants in the 
meeting recalled specifically what facts were discussed. Tim took a few notes 
about the conversation in his calendar, and the notes reflect that Tim was told 
that Moussaoui was an Arab who was in flight school and who had encouraged 
a friend of his to fight for the Muslim cause in Chechnya. Tim said that he did 
not recall discussing with Martin and Robin the Chechen rebels as a possible 
foreign power. Tim added that it was the role of the SSA and IOS, not the 


128 The Phoenix EC did not contain any references to Moussaoui, to any of the 


individuals who surfaced in the Moussaoui investigation, or to anyone associated with 
Oklahoma or Minnesota. 
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NSLU attorney, to identify the foreign power based on their analysis of the 
available intelligence. He also suggested that the reason that the Chechen 
rebels were not discussed as a foreign power was because, at the time, they 
were viewed as participants in a civil war, not as a terrorist organization. Tim 
told the OIG that while in theory the Chechen rebels could have been a foreign 
power, because “anything could be a foreign power,” it was his understanding 
that this did not happen in practice before September 11, 2001. He added that 
even if the Chechen rebels were considered a foreign power under FISA, the 
FBI still would have had to show that Moussaoui was an agent of that foreign 
power. 


Both Martin and Tim told the OIG that Tim’s advice was that the 
Minneapolis FBI lacked sufficient evidence of a foreign power to obtain a 
FISA warrant. Tim advised Martin that Minneapolis would have to collect 
more information supporting Moussaoui’s connection to a foreign power in 
order to obtain a FISA warrant. 


Tim told the OIG that Martin’s “attitude” in presenting the case was that 
“he didn’t think [Minneapolis] should get the FISA” but that Minneapolis 
“wanted one.” According to Tim, he was very busy with another matter at the 
time and advised Martin that if the project needed more attention, Martin 
would have to see another NSLU attorney. 


Tim told the OIG that he did not read the Phoenix EC until some time 
after September 11. With regard to whether it would have had an impact on his 
legal advice, Tim stated, “I can’t tell you it would have been enough for a 
FISA.” He also stated that the Phoenix EC would not have provided sufficient 
information to connect Moussaoui to a foreign power. But Tim said that, if he 
had known about the Phoenix EC, he would have taken it to an attorney in 
OIPR to discuss the Moussaoui matter in person, which he said was consistent 
with how he had acted in the past. He said that while “all Middle Eastern 
pilots” trained in the United States, the Phoenix EC would have provided a 
theory to attempt to connect Moussaoui to a foreign power under FISA.” 


129 We also asked Howard whether he had read the Phoenix EC since September 11 and 
if so, whether it would have made a difference to him in his analysis of whether the 
Minneapolis FBI had enough information to obtain a FISA warrant. Howard said that he 
only recently had read the Phoenix EC, but that if he had seen the Phoenix EC at the time, it 
(continued) 
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9. Martin tells Minneapolis its FISA request was not an 
emergency 


On August 24, Martin and Gary discussed the options for the 
Minneapolis FBI in pursuing a FISA warrant for Moussaoui. Martin asserted 
that the Moussaoui situation did not qualify as an emergency, which required 
information that an “imminent act of terrorism” was about to take place, and he 
added the FISA request lacked sufficient evidence of a connection to a known 
foreign power.” 


Gary’s notes from the conversation indicate that Martin stated that 
Minneapolis could write a Letterhead Memorandum (LHM) for the FISA 
request, have its CDC approve it, and that Martin would try to push it “up [the] 
food chain” at FBI Headquarters. However, according to Gary’s notes, Martin 
advised him that the FISA request could “take a few months” to complete, that 
there were “100s of these FISA requests,” and that the FBI had to prioritize 
them.'*' The notes also indicate that Martin said that he had showed the FISA 


(continued) 

would have “made a difference in the pucker factor,” and he would have called Rowley in 
Minneapolis and discussed the importance of tracking down the available leads to find out 
as much information about Moussaoui as possible. However, Howard said he believed that 
the Phoenix EC “would not have made a difference in the probable cause equation as it 
applie[d] to Moussaoui.” He explained that the problem with the Moussaoui case was the 
lack of a connection to a foreign power and nothing he read in the Phoenix EC contributed 
to that issue. 


' As discussed in Chapter Two, the SSAs and NSLU attorneys we interviewed told us 


that what rose to the level of an expedited FISA request depended on what the field office 
and ITOS management deemed to be an immediate priority, but the final decision would be 
made by the ITOS Section Chief, Michael Rolince. According to these witnesses, in the 
summer of 2001 expedited FISA requests normally involved reports of a suspected 
imminent attack or other imminent danger. 


131 Rolince and others told the OIG that there were always more FISA requests than 


ITOS resources and OIPR attorneys to complete all of them and have them heard before the 
FISA Court in the amount of time desired by the field office. Rolince stated that he 
instituted a policy that only the Section Chief was permitted to determine what constituted a 
priority and would be pushed to OIPR. He said that this arose out of the OIPR Counsel 
expressing to him that his attorneys were being called by SSAs and analysts making 
demands about what cases were priorities and had to be completed for presentation to the 
FISA Court. As a result of Rolince’s policy, field office managers would call Rolince to 
(continued) 
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request to an NSLU attorney and that office was not supportive of the 
application. 


Gary’s notes also indicate that Martin told Gary that “1-1-1/2 years ago 
we could have rammed this through.” Martin told the OIG that he did not 
remember making this statement but that he believes he was referring to the 
months after the bombing of the U.S.S. Cole in Yemen, which took place in 
October 2000. Martin said that after an act of terrorism or some other crisis 
situation, a significant amount of intelligence information is developed, which 
leads to more FISAs being obtained in a shorter amount of time. OIPR 
Counsel James Baker told the OIG that around the millennium in late 1999 and 
early 2000 the government had a heightened concern about terrorist attacks and 
was “aggressive” in its pursuit of FISA warrants, and the FISA Court “went 
along with them,” approving a significant number of FISA warrants in less 
than a month. 


Gary told the OIG that because he was new to counterterrorism matters, 
he relied on the advice that he received from Martin. 


10. Martin seeks information from FAA 


During this same time period, Martin initiated additional requests for 
information about Moussaoui. Martin advised the Federal Aviation 
Administration (FAA) representative at FBI Headquarters about the Moussaoui 
investigation and provided him with a copy of Henry’s 26-page EC. The FAA 
employee checked FAA databases for information about Moussaoui and 
obtained records indicating that he had registered for a student pilot’s 
certificate at the flight school in Norman, Oklahoma. The FAA employee 
e-mailed this information to the Minneapolis FBI and the RFU. 


(continued) 

assert their opinion that their case should be prioritized over others. Rolince explained that 
FISA renewals were generally of a higher priority than initiation of FISAs because with 
renewal requests the FBI was faced with the likelihood of not being able to renew the FISA 
if the previous FISA warrant order lapsed. He also stated that al Qaeda FISA requests were 
generally the priority, although there were times when another foreign power was the 
priority for a certain period of time because of a specific set of circumstances. 
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According to the FAA employee, he, Martin, and Robin met with Don 
when the Moussaoui matter first came to the RFU, and they discussed what the 
FBI could tell the FAA about Moussaoui. The FAA employee stated that they 
decided that since Moussaoui and Al-Attas were in custody and no other 
individuals were known to be working with them, the Minneapolis FBI would 
continue its investigation, but the FBI would not advise the FAA about the 
investigation at that point. 


11. Minneapolis FBI seeks assistance from the CIA and London 
Legat 


On August 24, after the Minneapolis FBI was told by Martin that the 
French information was not sufficient to link Moussaoui to a foreign power, 
the Minneapolis FBI sought assistance from other agencies to connect 
Moussaoui to al Qaeda or another foreign power. 


Henry e-mailed an FBI manager detailed to the CIA to ask him to 
determine whether the CIA had any information linking Moussaoui to a foreign 
power. A CIA counterterrorism employee e-mailed the FBI manager detailed 
to the CIA, who forwarded the message to Henry, that Ibn Khattab was “a 
close buddy with Bin Laden from their earlier fighting days and that the CIA 
employee’s interpretation of the French information was that Moussaoui was a 
“recruiter for Khattab.” Henry responded by e-mail to the FBI detailee and 
asked him to forward the e-mail to the CIA employee. In this e-mail, Henry 
asked the CIA employee if she had any additional information connecting Ibn 
Khattab to al Qaeda “other than their past association.” He also wrote, “We’re 
trying to close the wiggle room for FBIHQ to claim that there’s no connection 
to a foreign power.” Henry did not receive any response from the CIA to his 
request for additional information linking Moussaoui to a foreign power. 
According to the CIA employee, the CIA had no further information on any 
links between Moussaoui and terrorists, and this information was 
communicated to the FBI. 


Also on August 24, Henry e-mailed the FBI manager detailed to the CIA, 
who we call “Craig,” with names, telephone numbers, and other information 
obtained from Al-Attas’ address book. Henry requested that Craig ask the CIA 
to run traces on the information. Henry noted in the e-mail that he also was 
going to send copies of all of the documents found in Al-Attas’ possession. 
Henry wrote that there were many more domestic telephone numbers in the 
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information obtained from Al-Attas, and Henry had included only the foreign 
information in the e-mail. 


Also on August 24, the same day that Henry was exchanging e-mails 
with the CIA employee about obtaining information to connect Moussaoui to a 
foreign power, a CIA manager who was working in ITOS at FBI Headquarters 
as a “consultant” on intelligence issues e-mailed Don about the Moussaoui 
case. The CIA manager asked whether leads had been sent out to obtain 
additional biographical information, including any overseas numbers, and 
whether the FBI had obtained photographs and could provide them to the CIA. 
Martin responded to the e-mail and provided an update stating that requests for 
information and photographs already had been sent to the appropriate foreign 
intelligence agencies and to the CIA, and that the Minneapolis FBI had sent 
telephone numbers and addresses from Moussaoui’s and Al-Attas’ “pocket 
litter” to the CIA.'” Martin concluded the e-mail by writing, “[p]lease bear in 
mind that there is no indication that either of these two had plans for nefarious 
activity as was apparently indicated in an earlier communication.” (Emphasis 
in original.) 


Also on August 24, Henry e-mailed the FBI’s London ALAT, providing 
him with an update on the Moussaoui investigation and asking for assistance in 
establishing that Moussaoui was acting on behalf of a foreign power. Although 
the London ALAT contacted the British authorities twice in writing, made 
several telephone calls, and indicated the urgency of the Moussaoui matter, the 
British government did not provide the FBI any information about Moussaoui 
until September 12. We discuss the information and the ALAT’s efforts to 
obtain this information from the British authorities in Section J below. 


In addition to contacting the CIA and the London Legat directly, Henry 
contacted another FBI Headquarters employee who worked on intelligence 
matters and who we call “Carol.” In an August 24 e-mail, Henry reported the 
CIA employee’s statement that there was an association between Khattab and 
Bin Laden. Henry asked Carol for her assistance in establishing a connection 
between Moussaoui and a known terrorist organization, such as al Qaeda. 


132 «Pocket litter” is a term used to describe the contents of the pockets of a person who 
is taken into custody and searched. 
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Henry wrote that the RFU had determined that Minneapolis did not have 
sufficient evidence of a criminal violation for a criminal search warrant and 
that Minneapolis also lacked sufficient evidence to obtain a FISA warrant. He 
noted that the RFU had advised Minneapolis that “because Ibn Khatab [sic] has 
not yet been established to be a member of a named group, that Moussaoui is 
not acting at the direction of a foreign power.” He added, “I disagree, but that 
doesn’t matter.” He also e-mailed Carol a copy of his 26-page EC about the 
Moussaoui investigation. Henry told the OIG that he did not receive any 
information from Carol until September 10, when she sent him an e-mail 
inquiring whether he had been able to obtain a warrant. 


12. Minneapolis prepares emergency FISA request 


On the morning of Saturday, August 25, Henry completed the 
Minneapolis FBI’s formal FISA request, which consisted of a 6-page LHM, 
and e-mailed it to FBI Headquarters. The LHM stated that the Minneapolis 
FBI was requesting a FISA search warrant on an emergency basis and that 
Minneapolis “wish[ed] to emphasize the urgency of this matter in reminding 
recipients that Moussaoui is in INS custody pending deportation.” 


The LHM summarized Henry’s 26-page EC, including the statements 
received from the flight school representatives, that Moussaoui was arrested as 
an overstay on his visa and that deportation was pending and that he was in 
possession of two knives when he was arrested. The LHM also summarized 
Al-Attas’ statements about Moussaoui’s radical Islamic fundamentalist beliefs, 
including that Moussaoui believed that it was acceptable to kill civilians who 
harm Muslims. The LHM noted inconsistencies in Moussaoui’s statements, 
such as his unconvincing explanation for the large sums of money in his 
possession while he was in the United States and his inability to convincingly 
explain the reasons for his recent trip to Pakistan. With respect to information 
linking Moussaoui to a foreign power, the LHM contained three paragraphs. 
The LHM included the information provided by French authorities. The LHM 
also included the statement from the CIA employee that Ibn Khattab was 
“known to be an associate of Usama Bin Laden from past shared involvement 
in combat.” 


Both Gary and Henry told the OIG that they believed that based on the 
information they provided in the LHM, the Minneapolis FBI could support that 
Moussaoui was connected to Ibn Khattab and that because Khattab was 
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connected to Usama Bin Laden, al Qaeda could be used as the foreign power in 
the FISA application. 


Martin told the OIG, however, that he believed the information provided 
by the Minneapolis FBI to support a link between Ibn Khattab and Bin Laden 
was not sufficient to support a FISA request. According to Martin, it was 
“common knowledge” that there was a “purported” link between Khattab and 
Bin Laden. But he said that the most recent intelligence indicated that Khattab 
and Bin Laden were not connected. 


Robin told the OIG that she believed that trying to link Moussaoui to al 
Qaeda by arguing that Moussaoui was linked to Khattab, and Khattab was 
linked to Bin Laden, was “too far removed” to obtain a FISA warrant. She 
stated that based on intelligence information, it was known that Khattab and 
Bin Laden were “contemporaries” but were not connected to each other. She 
said that Khattab was not working for Bin Laden. 


13. Dispute between Minneapolis and Martin 


Around this time, Gary and Henry were becoming increasingly frustrated 
with the advice from Martin that they lacked sufficient information linking 
Moussaoui to a foreign power. On Monday, August 27, in a telephone call 
between Martin and Gary, the tension surfaced. 


According to Gary’s notes of the conversation, Martin told them that 
“what you have done is couched it in such a way that people get spun up.” 
Gary told the OIG that after Martin made this statement, Gary said “good” and 
then stated that Minneapolis was trying to keep Moussaoui from crashing an 
airplane into the World Trade Center. Gary’s notes of the conversation 
indicate that Gary stated, “We want to make sure he doesn’t get control of an 
airplane and crash it into the [World Trade Center] or something like that.” 
According to Gary’s notes, Martin responded by stating that Minneapolis did 
not have the evidence to support that Moussaoui was a terrorist. Gary’s notes 
indicate that Martin also stated, “You have a guy interested in this type of 
aircraft. That is it.” 


Martin told the OIG that he did not recall making any statement about 
Minneapolis getting “spun up” about the Moussaoui investigation. When 
asked whether he spoke with Minneapolis about whether they were 
overreacting, Martin stated that he “could have.” Martin told the OIG that he 
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never heard Gary make a statement that he thought that Moussaoui was going 
to hijack an airplane and crash it into the World Trade Center. He said that the 
first time that he heard that statement was in October 2001 at a meeting in FBI 
Headquarters involving several Minneapolis agents and FBI Headquarters 
employees to discuss the Moussaoui investigation. He said that during the 
meeting Gary made a reference to having made this statement to Martin some 
time in August 2001, but that Martin had never before heard Gary make the 
statement. 


Gary’s notes also indicate that the Minneapolis FBI asked Martin 
whether the FISA request, which had been e-mailed on Saturday, August 25, 
had been presented to Section Chief Rolince for approval as an emergency 
FISA. Martin stated that it had not been presented to Rolince. 


Gary’s frustration with Martin can be seen in an e-mail Gary sent to 
Martin on August 27 after their telephone conversation. In the e-mail, Gary 
advised Martin to contact the CIA employee for more information about 
Khattab and his connections to Bin Laden in order to support the foreign power 
portion of the FISA application. Martin responded in an e-mail on August 28 
that FBI Headquarters had the latest information on Ibn Khattab and Chechnya, 
“as this program is administered by our unit,” and that the matter had been 
discussed with the CIA employee. Martin also wrote, “I need to ask you guys 
to do me a favor. In the future, please contact and pass info to me and allow 
me to talk with [an FBI detailee to the CIA] and [the CIA]. Things work much 
better when our agencies are communicating HQ to HQ.” 


Martin’s e-mail was forwarded to Craig, the FBI detailee to the CIA with 
whom the Minneapolis FBI had been communicating. Craig responded with an 
e-mail to Gary, Martin, and Don, which stated that Craig definitely agreed that 


133 Martin told the OIG that normally contacts with other agencies are made by the 
SSAs at FBI Headquarters. He stated that he was concerned about the Minneapolis FBI 
communicating directly with the CIA because it was “not conducive to good information 
flow” and that FBI Headquarters needed to be “apprised of what’s going on.” He also 
asserted that since FBI Headquarters was responsible for putting the FISA request together, 
it was necessary for FBI Headquarters to ensure that it had all of the available information 
from outside agencies, and that this was more likely to occur when the agencies were 
communicating at the Headquarters level. 
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it was critical for FBI field offices to deal directly with FBI Headquarters in 
order to ensure that FBI Headquarters was “in the loop up front.” He added 
that in this instance he had been in touch with Don at the initiation of the case 
and that Don had asked the CIA to move quickly and without a formal request 
for information in the form of a teletype from FBI Headquarters. Craig wrote 
that it was for this reason that he had been dealing directly with the 
Minneapolis office but also coordinating with FBI Headquarters. Craig also 
wrote that the CIA had yet to receive a teletype from the FBI about the matter, 
which he described as “the only real, official communication between [the two 
agencies].” Craig also noted in a separate paragraph to Gary that FBI 
Headquarters “ha[d] a strong handle on the Chechen issue” and that the IOSs at 
FBI Headquarters were “well connected” to the CIA if they “require[d] 
anything new.” 


Henry told the OIG that he was frustrated with the advice that the 
Minneapolis FBI was receiving from FBI Headquarters and that he expressed 
this in a conversation with Martin. Henry said he told Martin that he disagreed 
with Don’s arguments for not pursuing the criminal warrant. He told the OIG 
that he had said to Martin: 


...if you’re not going to advance this the FISA route, or if 
you don’t believe we have enough for a FISA, I shudder to think 
—and that’s all I got out. And [Martin] cut me off and said, you 
will not question the unit chief and you will not question me. 
We’ve been through a lot. We know what’s going on. You will 
not question us. And that could be the mantra for FBI 
supervisors. 


14. Minneapolis contacts RFU Unit Chief 


Because of Gary’s and Henry’s frustrations in dealing with Martin, Gary 
told the OIG that he approached Roy, the Minneapolis Acting SAC, and asked 
Roy to call Don to “find out what [Martin]’s problem was.” '** On August 27, 


134 As discussed above, Roy was named the Acting SAC on August 3, 2001, and 


remained in this position until December 2001. Prior to being named the Acting SAC, he 
was one of two Minneapolis ASACs. 
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Gary and Roy together placed a call to Don to discuss the Moussaoui FISA 
request. 


According to Gary, Don was “immediately defensive” and asked Martin 
to join the call. Gary’s notes of the conversation do not indicate that Martin’s 
performance was discussed. 


Gary told the OIG, and his notes reflect, that Martin and Don discussed 
the lack of a foreign power and stressed that more direct connections were 
needed to establish the required link. Gary told the OIG that he recalled asking 
“what is the mechanism” to address the Moussaoui situation. He said that he 
asked Martin and Don if “they won’t let us go criminal” and if there was 
insufficient information for a FISA, “what can we do?” 


Gary’s notes indicate that he was advised that if Moussaoui could not be 
connected to a terrorist organization, there was “no mechanism to address on a 
case-by-case basis.” Gary’s notes also reflect that the question, “What is being 
done to address the loop-hole (if he isn’t part of a known group)?” was asked. 
Gary told the OIG that he posed this question. The reply is noted in quotation 
marks as “That isn’t something for you to worry about.” Gary told the OIG 
that he recalled that Don gave this reply. Don, however, told the OIG that he 
did not make this statement. 


Gary’s notes also indicate that either Don or Martin stated that another 
NSLU attorney — Susan — would review the matter and would give it a “good 


135 Because FISA warrants are permitted only for foreign powers or agents of foreign 


powers, the “lone wolf” terrorist who is not acting on behalf of any foreign government or 
terrorist organization is not covered by the FISA statute. In 2002, a bill was introduced in 
the United States Senate to amend FISA’s definition of “foreign power” to include “any 
person, other than a United States person, or group that is engaged in international terrorism 
or activities in preparation therefor.” The intent of the amendment was to allow a FISA 
warrant to be issued after showing that a person is engaging in or preparing to engage in 
international terrorism, regardless of whether that person also is an agent of a foreign power. 
The bill was referred to the Judiciary Committee, and the Senate Intelligence Committee 
held a hearing on the bill on July 31, 2002. There was no written report, and the bill was not 
reported to the full Senate. On January 9, 2003, the bill was reintroduced and was approved 
by the Judiciary Committee on March 11, 2003. It was approved by the Senate in May 
2003. A similar bill has been introduced in the House of Representatives. 
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faith review.” Gary told the OIG that Don gave this assurance. According to 
Gary, Don also advised the Minneapolis FBI that it was necessary to attempt to 
confirm that the information received from the French related to the same 
Moussaoui the INS had in custody. 


Roy told the OIG that he recalled having the telephone call but said he 
did not recall the substance of the conversation. He told the OIG, however, 
that he recalled that at some point he spoke to Don about Martin and expressed 
his belief that Martin was “hindering” the process or trying to “submarine” 
Minneapolis’ case. 


Don told the OIG that he recalled speaking on the telephone with Roy 
and Gary and discussing the foreign power issue. He said that his response to 
the disagreement was to have Susan — another NSLU attorney — weigh in on 
the merits of the FISA request. Don asserted that at no time did Roy or anyone 
else from Minneapolis raise any concerns to him about how Martin, Robin, or 
anyone else at FBI Headquarters was handling the case. 


Martin also told the OIG that he did not recall the specifics of this 
telephone conversation. However, with respect to the issue of ensuring the 
identity of Moussaoui, he stated that his concern was that the Minneapolis FBI 
practice “due diligence” and ensure that the information that the FBI had 
received was for the same person. Martin told the OIG that he was aware that 
the name “Moussaoui” had resulted in multiple hits in the FBI’s computer 
system when the Minneapolis FBI had first checked Moussaoui’s name. 


As aresult of this concern, after the telephone conversation with Don and 
Martin, Gary directed an agent on the Minneapolis counterterrorism squad to 
contact the FBI’s Paris ALAT to obtain information about the number of 
persons with the name Zacarias Moussaoui in France by checking the 
telephone books for the name Zacarias Moussaoui. In an e-mail later that day 
to the Paris ALAT, the Minneapolis agent wrote, “In an effort to demonstrate 
the probability, which we believe is low, can you determine just how many 
Zacarius [sic] Moussaoui’s [sic] are listed in the white pages in France. [sic]” 
The ALAT replied by e-mail that he could check the white pages for Paris but 
he might not be able to check the white pages for all of France. He also wrote 
that he was meeting with the French authorities the next day and was expecting 
them to provide additional information that would “confirm Moussaoui’s 
identity.” 
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On August 30, the ALAT provided additional information obtained from 
the French authorities that confirmed Moussaoui’s identity to Minneapolis and 
FBI Headquarters. This information is discussed in Section F, 20 below. 


Henry told the OIG that he thought that Martin’s suggestion that the 
Minneapolis FBI do more to confirm that Moussaoui was the same Moussaoui 
as reported by the French was “another arbitrary roadblock.” He said that he 
believed that they should trust the professionalism of the French, although he 
also said that he was not aware of the specific information that the French 
authorities were relying on to assert that the Moussaoui in custody was the 
same Moussaoui as in their report. 


Rolince told the OIG that some time in August 2001, Don stopped briefly 
at his office to give him a “heads up” on a case in the Minneapolis Field 
Office. Rolince said that the conversation lasted approximately 20 seconds. 
Rolince said he did not recall if Don mentioned the name Moussaoui or not. 
According to Rolince, Don indicated there was an issue with a FISA and 
Rolince might receive a call from FBI management in Minneapolis. Rolince 
said Don told him the subject of the investigation was in jail on an immigration 
charge and the logical leads had been sent out. Rolince told the OIG he did not 
receive any further details from Don about the issue in Minneapolis, but this 
type of heads up was not atypical. Rolince stated that he received this type of 
brief notification as often as 10-15 times a week from his subordinates about 
potential contacts from the field. 


Rolince told the OIG that he never received a telephone call or other 
contact from the Minneapolis FBI about the Moussaoui matter. He said that he 
did not raise the limited information he received from Don about the 
Moussaoui investigation with anyone else in the FBI. 


15. Martin and Robin’s consultation with NSLU attorney Susan 


After the call with Minneapolis on August 27, Martin and Robin met 
with NSLU attomey Susan to discuss the Moussaoui FISA request. Martin 
told the OIG that he orally briefed Susan about the facts of the case. He did not 
provide her with any of the documentation that had been generated, such as the 
26-page EC or the 6-page LHM, although he had the documents with him at 
the meeting. Martin told the OIG that while he did not recall specifically what 
was discussed with Susan, he recalled that she did not believe that there was 
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sufficient evidence of a connection to a foreign power. Martin added that he 
recalled informing Susan of the facts that related to the issue of the foreign 
power, which was the information received from the French authorities. 


According to Susan, the meeting lasted approximately 45 minutes. She 
said she was made aware of a handful of other facts, such as that Moussaoui 
was an Arab, was in flight school and had been asking some weird questions, 
and had paid cash for flight school. 


Susan told the OIG that Martin and Robin downplayed the Khattab 
information to her. She stated, however, that she believed the evidence of a 
link between Moussaoui and Khattab was very “tangential” since it was based 
on the statement of Tufitri who had no direct knowledge of a connection 
between Moussaoui and Khattab. In addition, Susan told the OIG that based 
on her experiences in ITOS, the Chechen rebels would not have been accepted 
by OIPR as a foreign power. Susan told the OIG that based on the facts that 
she was presented, she told Martin and Robin that the FISA request lacked the 
necessary connection of Moussaoui to a foreign power. 


Susan told the OIG that attempting to argue that Khattab was part of al 
Qaeda was not feasible, because at the time the FBI’s position was that Khattab 
did not take direction from Bin Laden but rather was the leader of the rebels in 
Chechnya. She said that it was her understanding at the time that the CIA and 
the FBI did not agree about Khattab’s role and relationship to Bin Laden. "° 
Susan also stated that in her experience it would not have been feasible to get 
an emergency FISA through OIPR if a new foreign power that had never been 
pled before was presented. 


Susan told the OIG that she asked Martin and Robin whether the FBI had 
any information indicating anyone was sending people to the United States for 
flight training, but that she was told no. She said that Robin did not mention 
the Phoenix EC to her. Martin told the OIG that he did not recall any such 


138 The FBI IOSs we interviewed told the OIG that the CIA, not the FBI, collected 
intelligence information on the Chechen rebels and Khattab. According to the IOS who was 
responsible for targets in Chechnya, by the spring of 2001 both the CIA and the FBI took the 
position that Khattab did not take direction from Bin Laden. 
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question from Susan. Robin also told the OIG that Susan never brought up the 
issue of whether Middle Easterners were training in U.S. flight schools. 


We asked Susan whether she had read the Phoenix EC since 
September 11 and whether it would have made a difference to her opinion 
about the Moussaoui FISA request. Susan said that she first read the Phoenix 
EC several months after September 11. She said that if she had read the 
Phoenix EC at the time, she would have been concerned enough about 
Moussaoui to bring the matter to an OIPR attorney’s attention. According to 
Susan, she sometimes called OIPR attorneys “to bounce things off” them, 
rather than sending over a formal FISA request, and would ask them “where do 
you think we are?” Susan added that the Moussaoui case still would have had 
“the same foreign power issues” but that the Phoenix EC would have 
“influenced” her. 


Susan also told the OIG that she had not been aware at the time of her 
meeting with Martin and Robin that the Minneapolis FBI had prepared a 
lengthy EC about the Moussaoui case. She stated that she thought that the case 
“was evolving” as she spoke to Martin and Robin and that she did not realize 
that documentation had been prepared. She said she believed that Martin had 
received oral briefings from Minneapolis. She said that she first became aware 
of Henry’s EC in November 2001. However, she said that if she had read it 
before the meeting with Martin and Robin, it would not have changed her 
opinion about the Moussaoui FISA request. She said she recalled thinking that 
Martin had represented the facts as set forth in the EC. Susan stated that she 
probably received an oral briefing because Minneapolis was seeking an 
emergency FISA and needed an answer quickly. She said that there was 
nothing unusual about receiving an oral briefing in that situation. Susan told 
the OIG that she did not know at the time that Martin had already consulted 
with Howard and Tim about the same case. 


After the consultation with Susan on August 27, Don instructed Martin to 
have the matter reviewed again by the head of NSLU, Spike Bowman, because 
of the level of concern raised by the Minneapolis FBI about Moussaoui and the 
FISA request. Martin arranged for a meeting with Bowman the next afternoon, 
August 28. 
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16. Martin’s edits to Minneapolis’ FISA request 


Prior to the meeting with Bowman, Martin began reviewing and editing 
the Minneapolis FBI’s 6-page LHM, in case the FISA request was approved by 
Bowman. Martin e-mailed an edited draft of the LHM to Gary and stated that 
he had made some refinements and wanted comments from Minneapolis. 
Martin noted that he had removed the paragraph reflecting that a CIA 
employee had stated that Khattab was an associate of Bin Laden, but that 
Martin would “add the foreign power info re Al-Khattab/UBL later, when we 
get an [attorney] to buy this argument.” 


Gary responded with a lengthy e-mail setting forth his concerns about 
Martin’s edits. First, Gary expressed concern about the removal of the 
statement connecting Khattab to Bin Laden. Gary wrote, “It seems that we are 
setting this up for failure if we don’t have the foreign power connection firmly 
established for the initial review.” Gary also raised questions about the 
following made by Martin: 


e Change from the statement about Moussaoui “preparing himself 
to fight” to a statement that Moussaoui and Al-Attas “train 
together in defensive tactics.” Gary wrote, “During the interview 
neither Al-Attas nor [Moussaoui] used the term ‘defensive 
tactics.’ I think that softens our argument and misrepresents the 
statements of Al-Attas.” 


e Change to the statement “Al-Attas was also asked if he had ever 
heard Moussaoui make a plan to kill those who harm Muslims 
and in so doing become a martyr himself. Al-Attas admitted that 
he may have heard him do so, but that because it is not in his own 
heart to carry out acts of this nature, he claimed that he kept 
himself from actually hearing and understanding.” Martin 
changed this section to read, “Al-Attas was also asked if 
Moussaoui has a plan to kill those who harm Muslims and or to 
martyr himself while conducting an act of terrorism. Al-Attas 
indicated that Moussaoui may have such a plan, but that he does 
not know for certain if this is the case.” Gary acknowledged that 
Martin had changed the statement based on a previous telephone 
conversation with Gary, but Gary wrote “now that I see it in print, 
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I think we might be misstating Al-Attas’ response” to the 
question. 


e Change from the statement that “Moussaoui was unable to give a 
convincing explanation for his paying $8300 for 747-400 
training” to “Moussaoui would [sic] give an explanation for his 
paying $8,300 in cash for 747-700 flight simulation training.” 
After noting that Martin had left out the “not,” Gary stated that he 
did not think that this statement was accurate because Moussaoui 
gave an explanation “but it was not convincing.” 


e Change from the statement that Moussaoui had no convincing 
explanation for the large sums of money known to have been in 
his possession during his time in the United States” to 
“Moussaoui would not explain the large sums of money known to 
have been in his possession during his time in the United States.” 
Gary noted here again that Moussaoui had offered an explanation 
but that “his explanation fell short.” 


e Change from the statement that “Tufitri stated that Moussaoui 
was ‘the dangerous one’” to Tufitri “described him as being 
dangerous.” Gary pointed out that Tufitri “did not describe him 
as being dangerous in general terms, Tufitri specifically referred 
to him as ‘the dangerous one.’” Gary added, “I think this is 
significant — and it accurately reflects the information as it was 
provided by [the French authorities]. 


Martin responded by e-mail to Gary the same day. With regard to Gary’s 
concerns about the foreign power information, Martin explained that Robin 
would be pulling together the information required for the foreign power 
section of the FISA application and that it would be added to the LHM once it 
was ready to be sent to OIPR. Martin added, “Don’t worry about this part.” 


Martin also wrote that he would make some of the changes requested by 
Gary. For example, with respect to the “would not give an explanation” 
comment, Martin changed the text to “did not give a logical explanation.” 
With respect to Gary’s concern about Moussaoui’s inability to explain the 
source of income, Martin wrote, “I added words to cover your point.” 
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Martin declined to make some of the other changes requested by Gary 
and offered explanations for his edits. With respect to the “defensive tactics” 
change, Martin wrote, “We don’t need to provide verbatim answers to 
[interview questions]. I think the way I’ve set it out here is accurate.” With 
respect to the question put to Al-Attas about whether he had heard Moussaoui 
make a plan to kill people who harm Muslims, Martin wrote that he did not 
believe how it had been written made sense and that “the way it reads in [my] 
draft is fine.” With respect to the “dangerous one” comment, Martin wrote that 
what was in the paragraph was adequate. 


At the end of the e-mail, Martin wrote, “I tried to tighten up the language 
and make it more concise. There’s not necessarily anything wrong with [the 
LHM] - I’m just trying to make an adjustment for our new targeted audience.” 


Gary told the OIG that he believed Martin’s edits “softened” the FBI’s 
position. He said that he questioned why Martin had taken out the foreign 
power information when it was legally required to obtain the FISA warrant, 
and claimed he was given “no real explanation” for why Martin omitted the 
foreign power information. Henry told the OIG that he believed that Martin’s 
edits appeared to be “dumbing [the LHM] down” and that the edits “would 
definitely cause [the FISA request] to fail.” 


In response, Martin told the OIG while he believed that the LHM was 
generally well-written, the three paragraphs for the foreign power section of the 
LHM were not adequate to establish the foreign power element, and he 
intended, along with Robin, to compile a “real” foreign power section when an 
NSLU attorney gave approval to move forward with the FISA request. Martin 
said that handling the request this way was common and denied that he was 
attempting to “torpedo” the case. 


Robin also told the OIG that, as they did with other cases, she and Martin 
were preparing to create a new foreign power section for the Moussaoui LHM 
that would be comprehensive. She said that Martin’s edits were normal and 
that the changes were designed to create “a logical, intelligent package that we 
thought would get to court” and to make the LHM less “inflammatory.” She 
explained that by “inflammatory” she meant that the Minneapolis LHM was 
not focused, but rather used terms that were geared toward getting someone’s 
attention without providing any evidentiary support. Robin asserted that 
Martin was streamlining the document and adding the “buzzwords” that he 
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knew from experience OIPR would require in order to get the package to the 
FISA Court. Robin stated that the RFU wanted FISA requests to get OIPR’s 
attention but did not want the RFU to seem like “maniacs.” 


17. Consultation with NSLU chief Spike Bowman 


On the afternoon of August 28, Martin and Robin met with Bowman to 
discuss the Moussaoui FISA request. Don told the OIG that he had planned to 
attend the meeting but that on his way to Bowman’s office he was called into a 
meeting with Section Chief Rolince. No one from Minneapolis was asked to 
participate in the meeting. 


Bowman told the OIG that it was “quite unusual” for him to be consulted 
about a particular FISA request. He said that it also was unusual for the field 
office to be so adamant that it had sufficient evidence to obtain a FISA warrant 
and for the Headquarters SSA to be as adamant that the FISA warrant was not 
sufficiently supported. 


Martin orally briefed Bowman about the facts of the Moussaoui case but 
did not provide him with any of the documentation that he had with him. 
Robin told the OIG that she thought that Bowman was very familiar with the 
facts because he had been briefed by other attorneys who had been involved in 
the matter. 


Martin said that Bowman advised that even if everyone were to agree that 
the Chechen rebels could be pled as a foreign power, the Minneapolis FBI 
lacked sufficient evidence to establish that Moussaoui was an agent of that 
foreign power. Martin told the OIG that Bowman said that Tufitri stating that 
Moussaoui told Amnay how to serve Allah by fighting with the Chechen rebels 
did not meet the standard of an agent of a foreign power. 


According to Bowman, Martin conveyed the opinion that he did not 
believe there was sufficient information for a FISA. Bowman said he was 
aware that Moussaoui was a French citizen who had overstayed his visa, that 
he was a bad flight school student who paid in cash and who could not 
satisfactorily explain how he was being supported in the United States, that he 
was asking odd questions about the airplane (such as whether you could open 
the doors during flight), that he was more interested in learning how to take off 
and land the airplane than flying it, that he was traveling with a friend who did 
not seem to share his interest in aviation, and that the French authorities had 
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reported that Tufitri was blaming Moussaoui for recruiting Amnay to fight in 
Chechnya on behalf of the rebels there. 


Bowman told the OIG that he did not believe, based upon the facts, that 
there was sufficient evidence of a link to a foreign power. He said that he was 
aware that the Minneapolis FBI wanted to argue that because there was some 
connection between Moussaoui and Khattab and because there was a 
relationship between Khattab and Bin Laden, Moussaoui was an agent of al 
Qaeda. Bowman said that it was his understanding that it was common 
knowledge that Khattab and Bin Laden had “some kind of relationship,” but in 
his opinion this was not a close enough link to argue that Moussaoui was an 
agent of al Qaeda. Bowman also stated that one Muslim encouraging another 
Muslim to fight in a Muslim cause was not sufficient to meet the requirements 
of an agent of a foreign power under FISA. +” 


We asked Bowman whether he had read the Phoenix EC and whether it 
would have made a difference in his advice. Bowman stated that he read the 
Phoenix EC only after September 11, but that he believed for several reasons it 
would not have made any difference if he had read it at the time. He asserted 
that the Phoenix EC was a routine communication pointing out what a field 
office believed was an “anomaly” and that it was not an “alarmist” 
communication. In addition, he said that the Phoenix EC did not connect any 
of the people referenced in the Moussaoui case with any foreign power. He 
said that it did not “associate Moussaoui with anything.” 


After meeting with Bowman, in an e-mail to Gary and Acting SAC Roy, 
Martin informed the Minneapolis FBI of Bowman’s opinion that there was 
insufficient evidence of a connection to a foreign power. Martin wrote: 


We just left a meeting w/ Spike Bowman, #1 in NSLU. He says 
we have even less than I thought. Apparently, even if we could 
show that the ZM that recruited [the person] in France is the one 


137 As discussed in Chapter Two, the legislative history of FISA provides that to meet 


the definition of an agent of a foreign power, there must be “a nexus between the individual 
and the foreign power that suggests that the person is likely to do the bidding of the foreign 
power” and that there must be a “knowing connection” between the individual and the 
foreign power. 
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you have locked up in INS detention, we still don’t have a 
connection to a foreign power. We would need intel to indicate 
the guy was actually a part of the group, an integral part of the 
movement or organization, and not just an individual 
[redacted].” 


In the e-mail, Martin advised Gary to call him to discuss the next course of 
action. Roy responded by e-mail and wrote, “Thanks for your help and 
continued support.” 


Gary’s notes indicate that Martin and Gary also spoke on the telephone 
after the Bowman meeting and Martin explained that the FBI needed more 
information linking Moussaoui to a foreign power. The notes state that Martin 
told Gary, “we need [Moussaoui] to be an integral part of a terrorist 
organization.” *® The notes also indicate that Martin conveyed that more 
intelligence information was needed on “how he is acting on behalf of a 
foreign power.” The notes state: “Bottom Line — You don’t have a foreign 
power.” The notes also state that Martin advised Gary to ensure that 
Moussaoui was entered on a watch list and that the FBI’s Paris Legat was 
contacted about deportation arrangements for Moussaoui (which we discuss 
below). 


18. Additional information about Al-Attas and Moussaoui 


a. Minneapolis FBI explores use of undercover officer in 
Moussaoui’s jail cell 


In an e-mail from Gary to Roy on August 29, Gary wrote that he and 
Henry were “exploring the feasibility” of inserting an undercover officer who 
spoke Arabic in Moussaoui’s jail cell “in an attempt to elicit from Moussaoui 


138 Bowman told the OIG that Martin accurately conveyed his advice that even 


assuming that there was a foreign power to which the FBI could attempt to connect 
Moussaoui, the Minneapolis FBI lacked sufficient evidence to establish that Moussaoui was 
acting as an agent on behalf of a foreign power. He stated, however, that Martin’s 
interpretation of his advice that agency law requires a showing that the target was an 
“integral part” of the terrorist organization was not correct. He opined that the agency 
standard required a showing that the target was “serving the interest” of the foreign power. 
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the name of (or descriptive information which would identify) the recognized 
foreign power with whom he is aligned.” Gary told the OIG that Roy, Charles, 
and Rowley all were consulted about this idea, and all of them stated that they 
did not see any limitations that would prevent this from occurring. Gary noted 
in the e-mail that the Minneapolis FBI did not know yet whether the use of the 
undercover officer for the proposed operation had been approved. 


Roy provided the information about using an undercover officer to Don 
in an e-mail in which he wrote, “The use of the [undercover officer] is also 
exploratory as we do not want to leave any stone unturned prior to 
[Moussaoui’s] release.” Don responded in an e-mail and wrote, “Let us look 
into this asap. Do NOT go forward with the [undercover officer] until we 
weigh in....” Roy replied, “We were only been [sic] exploring the possibility 
of the [undercover officer] — we are by no means ready to go forward with it. 
The point may be moot because it seems the deportation to France is a more 
likely outcome and it may be more timely.” 


Don told the OIG that he discussed the issue with an employee detailed 
to ITOS with expertise in this area and that the employee stated that the idea 
was “ridiculous” and that it could not be done. Don said that having an 
undercover employee involved with something in which information could be 
obtained that might be used in a criminal proceeding was problematic since the 
undercover officer would not be in a position to testify. According to Don, he 
conveyed this information to Roy, and Minneapolis did not pursue this idea 
further. 


b. ‘Translations of recorded conversation between Al-Attas 
and “Ahmed” and Al-Attas’ will 


With regard to Al Attas, Henry asked an Arabic speaker who was not 
employed by the FBI to translate Al-Attas’ will, and to translate and transcribe 
the tape of a 9-minute conversation between Al-Attas and the individual we 
call “Ahmed,” the imam from Al-Attas’ mosque whom Al-Attas called while 
he was in custody. According to an e-mail from Gary to Roy on August 29, the 
translation by the translator stated Ahmed had said on the tape, “I heard you 
guys wanted to go on Jihad.” Gary’s e-mail also stated that the translator 
reported that Al-Attas immediately responded on the tape, “Don’t talk about 
that now.” In addition, Gary’s e-mail stated that the translator informed the 
Minneapolis FBI that Ahmed became very upset when he heard that 
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Moussaoui was going to be deported. Gary’s e-mail added that, according to 
the translator, the translation of the will that Al-Attas had with him stated that 
“death is near” and that “those who participate in Jihad can expect to see 
God.” 139 


On August 29, Roy transmitted the information from the will to Don by 
e-mail, stating, “I obtained some additional information this afternoon and I am 
forwarding that to you. Please understand that this is only preliminary and we 
realize the interpretation was not done by a certified linguist.” Roy did not ask 
that Don do anything in particular with the information. 


Don responded by e-mail, writing, “The ‘will’ is interesting. The Jihad 
comment doesn’t concern me by itself in that this word can mean many things 
in various muslim [sic] cultures and is frequently taken out of context.” Don 
told the OIG that the term “jihad” often was used and had many different 
meanings. 


19. Failure to reconsider seeking a criminal warrant 


After Martin conveyed to the Minneapolis FBI that FBI Headquarters 
believed that the FISA warrant was not feasible, the Minneapolis FBI and FBI 
Headquarters began taking steps to finalize Moussaoui’s deportation. Yet, 
neither FBI Headquarters nor the Minneapolis FBI reconsidered the criminal 
search warrant issue or trying to contact the Minneapolis U.S. Attorney’s 
Office (USAO) about a criminal search warrant, even after the legal decision 
was made that insufficient evidence existed to obtain a FISA warrant. Initially, 
as noted above, the decision was made not to seek a criminal warrant, in part 
because if a criminal warrant was not obtained, this would violate the “smell 
test” and jeopardize the chances of obtaining a FISA warrant. Once the FISA 


139 The will and the tape also were sent to the FBI’s Chicago Field Office for translation 
and transcription by an FBI linguist, which was completed around September 6, 2001. The 
Chicago translation of the tape was the same as that of the initial translator: “Sheikh do not 
talk about it now. Do not talk about it now sheikh.” The Chicago translation said the will 
stated that “death has approached” and expressed Al-Attas?’ hope that “Allah will award him 
with paradise and keep him with the prophets, martyrs and pious.” Henry forwarded these 
translations to FBI Headquarters in an e-mail dated September 6, 2001, with a lead that 
stated “For information.” 
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warrant was ruled to be unobtainable because of the foreign power 
requirement, the smell test was no longer an issue. Yet, no one sought to 
attempt to obtain a criminal warrant, or apparently even discussed this issue. 


Don told the OIG that he did not know why he, Martin, or the 
Minneapolis agents did not raise the issue again about seeking a criminal 
search warrant, once a decision was made not to pursue the FISA warrant. He 
suggested that it did not happen because no one thought to raise the matter 
again. Don said that looking back on the matter now, he wished that there had 
been a discussion about seeking a criminal warrant once the FISA route was 
exhausted. Martin told the OIG that if the Minneapolis FBI believed that it had 
sufficient evidence to obtain a criminal search warrant, then the Minneapolis 
FBI should have raised the issue. He said, however, that he did not believe that 
there was sufficient evidence of a crime to obtain a criminal search warrant. 


When Henry was asked why he did not propose seeking a criminal 
warrant once the FISA route was exhausted, he responded, “I never thought 
about it.” He stated that he “could have done that but it did not occur to 
[him].” Gary told the OIG that he did not pursue a criminal search warrant 
because FBI Headquarters would not obtain the requisite authorization from 
the Department of Justice. Rowley told the OIG that she did not know why a 
criminal warrant was not sought once the FISA route was exhausted. She 
noted that she did not have a leadership role in the case and she felt that the 
people who were involved knew what they were doing. 


20. Additional French information received about Moussaoui 


On August 30, the FBI’s Paris ALAT provided additional French 
information to the Minneapolis FBI and FBI Headquarters about Moussaoui. 
The ALAT’s report included information from a person who we call “Idir” 
who knew Moussaoui.'“° Idir confirmed the relationship between Moussaoui 
and Amnay. Upon learning of Amnay’s death, Idir had accused Moussaoui of 
causing the death. Idir explained that Moussaoui had become a radical 
fundamentalist and that he had brought Amnay to these beliefs. He said that 


14 We do not use Idir’s real name because the FBI considers that information to be 


classified. 
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Moussaoui and Amnay “were inseparable, one was the head and the other was 
the armed hand of the same monster.” Amnay states that when Moussaoui had 
come to his community, Idir had warned the local Muslim community of the 
moral danger Moussaoui posed to young Muslims and that Moussaoui was 
“driven from at risk urban areas by his coreligionists for propagating 
hismessage of intolerance and hatred.” 


The report from the Paris ALAT also stated that Idir recalled that 
Moussaoui had traveled to Kuwait, Turkey, and Afghanistan. Idir said 
Moussaoui was a “strategist” who was potentially very dangerous and was 
devoted to Wahabbism, the Saudi Arabian sect of the Islamic religion adhered 
to by Bin Laden. Idir also described Moussaoui as “extremely cynical” and “a 
cold stubborn man, capable of nurturing a plan over several months, or even 
years and of committing himself to this task in all elements of his life.” The 
date of birth Idir provided for Moussaoui was the same as the one in 
Moussaoui’s passport, which had been seized upon his arrest in Minneapolis. 


The Paris ALAT’s report also stated that the ALAT had inquired with the 
French authorities about deporting Moussaoui to France and that the French 
authorities were interested in pursuing the matter. In the lead portion of the 
EC, the Paris ALAT wrote a lead for the Minneapolis FBI that stated, “With 
FBIHQ concurrence and assistance, advise Legat Paris of interest in further 
exploring the possibility of deporting [Moussaoui] by U.S. law enforcement 
escort to France as described in the text of this EC.” The lead for the RFU was 
a “read and clear” lead. 


Gary’s notes indicate that Martin brought this new information to Gary’s 
attention in a telephone call on August 30. In addition, Martin advised him that 
the French government would be able to hold Moussaoui for several days with 
his property quarantined. The notes reflect that Martin told Gary that the 
French authorities were “very interested in Moussaoui” and that they wanted 
him “escorted to France” and his “property quarantined.” Gary’s notes also 
indicate that Martin advised Gary that the French terrorism statutes would 
allow the French to hold Moussaoui for “several days to determine what he’s 
up to.” 
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G. Deportation plans 


Martin and the Minneapolis FBI coordinated with the INS to finalize 
plans for Moussaoui’s deportation. Under the law, Moussaoui could be 
deported to either France, his country of citizenship, or England, his country of 
last residence. The French advised that they could hold Moussaoui and search 
his belongings, and on approximately August 30, it was decided to deport 
Moussaoui to France. 


During the deportation planning, the Minneapolis FBI and the FBI Paris 
ALAT requested permission from FBI Headquarters for Henry and an INS 
agent to accompany Moussaoui to France in order to brief French authorities 
and to assist in evaluating the information obtained in the search. Minneapolis 
Acting SAC Roy wrote in an August 30 e-mail to Don that the French 
authorities were requiring that Moussaoui be accompanied by a law 
enforcement officer from the United States and that Moussaoui’s property be 
kept separate from him. Roy wrote, “If possible, we would like the 
Minneapolis agents to be present while the exploitation of the computer is 
conducted so we can act immediately on any information obtained.” 


Don initially was opposed to sending FBI agents to escort Moussaoui. 
He sent a reply e-mail to Roy on August 31 stating that he believed that the 
deportation of Moussaoui should “remain an INS issue.” (Emphasis in 
original.) Don wrote in the e-mail the Minneapolis FBI should ensure that the 
FAA was involved and noted that FAA sky marshals were armed. 


Section Chief Rolince told the OIG that he also was initially opposed to 
sending a Minneapolis agent with Moussaoui to France. He said that at first he 
thought it was unnecessary because, based on his past experience, the agent 
would have accompanied Moussaoui in an attempt to obtain information. He 
said that he changed his mind when it later was explained to him that the 
Minneapolis agent was going to accompany Moussaoui as part of an overall 
strategy to ensure that Minneapolis obtained all of the information from the 
search and further investigation. 


Roy replied by e-mail to Don a few minutes later and asked whether 
Don’s e-mail meant that FBI Headquarters would not support a Minneapolis 
agent accompanying Moussaoui to France. Gary also provided additional 
information to Don, such as that the French authorities preferred that an FBI 
agent accompany Moussaoui to France and that Martin had informed the 
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Minneapolis FBI that FAA sky marshals would not be traveling with 
Moussaoui.“ 


Don replied by e-mail three hours later, stating that he could not discuss 
the matter at the moment but would call Roy the following week. Don added 
that he did not believe that the FBI would be turning over the case to the 
French authorities by not sending an FBI agent to escort Moussaoui. He added 
that the FBI’ s Paris ALAT would be present for the search and had been 
involved with the Moussaoui investigation from the beginning. 


On September 4, Don, Martin, and Roy received an e-mail from the Paris 
ALAT in which he stated that he wanted to confirm the deportation plans. He 
wrote that it was his understanding that the proposal was to send Moussaoui to 
Paris with an INS escort and the FBI case agent. The ALAT noted that “[t]his 
would fit nicely with what the French have requested” and that the agents 
would need to stay in France a couple of days to assist with briefing the French 
authorities and to obtain the results of the search by the French authorities. 
Martin replied by e-mail that Don “still [held] the position that [Moussaoui] 
will be escorted by INS, and that no FBI personnel is needed.” Martin also 
wrote that because the case had been opened only two weeks and because the 
interviews were well documented, the ALAT and the French authorities should 
be able to handle the case without the FBI sending the case agent. 


The Paris ALAT responded by e-mail to Don, providing his opinion on 
whether a Minneapolis agent should accompany Moussaoui to France. The 
ALAT stated that he did not feel that he was in a position to adequately answer 
some questions that could be raised about the FBI’s investigation of 
Moussaoui, such as other investigation conducted of which the ALAT was 
unaware, and questions about Moussaoui’s personality for purposes of 
approaching him in an interview. He wrote that he therefore believed that an 
agent from Minneapolis or FBI Headquarters should accompany Moussaoui. 


Don responded to the ALAT’s e-mail the same day. He wrote, “Do we 
need to fly FBI agents all over the world to conduct basic investigation. [sic] I 
don’t like the idea of [a Minneapolis FBI agent] ‘escorting’ this guy --- This is 


141 Martin’s e-mail about the FAA stated, “[The FAA] did not indicate a desire to escort 


the guy, and indicated the INS escort would suffice.” 
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not that complicated. It may be to [sic] late, but in the future I would like [the 
ALAT] to handle such matters.” 


The next day, September 5, Henry e-mailed Martin about a meeting he 
had with the INS supervisor who was going to be responsible for sending 
Moussaoui to France. Henry explained that the INS supervisor had raised a 
number of issues about the deportation of Moussaoui and recommended that 
the FBI request that the INS transport Moussaoui on a government aircraft (a 
Justice Prisoner Alien Transportation System (JPATS) flight). Martin 
responded to this e-mail by stating that he would discuss the issue with the INS 
supervisor assigned to the RFU. Martin also forwarded the e-mail to Don. 


Don replied the next day, September 6, writing, “Isn’t a JPATS flight 
awful expensive for a guy SUSPECTED of being up to no good??? Again, I’m 
of the belief that we consider that a FAA sky marshal(s) be present on the 
flight.” 


According to Gary, he repeatedly asked Roy to raise the issue at a higher 
level at the FBI regarding Minneapolis agents accompanying Moussaoui to 
France. According to Gary, Roy was waiting for a call back from Don, and 
because Don had not given Minneapolis a definite “no,” Roy was hesitant to go 
up the chain of command. 


According to Roy, he did not hear from Don about the deportation issue. 
When Don still had not responded by Monday, September 10, Roy sent another 
e-mail to Don asking whether he had given consideration to a Minneapolis FBI 
agent escorting Moussaoui. 


Don replied by e-mail a few hours later stating that FBI Headquarters 
decided to concur with a Minneapolis agent accompanying Moussaoui to 
France. 


Gary also told the OIG that he had suggested at some point that Roy “go 
up” the chain of command about Minneapolis’ FISA request, but that Roy did 
not. Gary told the OIG that he believed that Roy was “not aggressive enough” 
because he did not appeal to anyone in upper management at FBI 
Headquarters, but that Roy may have decided to focus on the deportation issue 
and “drop” the FISA issue. Gary told the OIG that he believed that part of the 
reason that Roy did not contact anyone above Don about the Moussaoui FISA 
request was because he was an acting SAC, and also possibly because Roy did 
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not have any international terrorism experience. Gary also said that Gary 
himself was “on a learning curve too,” and that if he had more experience, he 
would have sought assistance from someone above Don with trying to get FBI 
Headquarters to submit the Moussaoui FISA request to OIPR. 


Roy responded to this issue by stating that he did not go above Don 
because, before the September 11 attacks, there was no apparent “urgency” to 
the Moussaoui matter, and he believed that the Minneapolis FBI had taken the 
matter through the appropriate channels, since the head of the NSLU also had 
given his opinion on the FISA request. Roy added that shortly after Bowman’s 
opinion was received, the deportation plan was in place and that plan was 
going to result in Moussaoui’s belongings being searched, which was what 
Minneapolis was attempting to achieve. 


H. Dissemination of information about Moussaoui 


On August 28, Don received an e-mail from the FBI detailee to the CIA 
who we call Craig, which indicated that the CIA had not yet received a formal 
communication from the FBI about the FBI’s requests in the Moussaoui 
investigation. Don e-mailed Martin and Robin on August 31 to request that 
they prepare a “comprehensive teletype” to the CIA about Moussaoui. Don 
wrote that they should pass to the CIA all information, such as biographical 
information, pocket litter, and telephone numbers, and formally ask for traces 
on all of the information even though the requests already had been made 
informally. Don noted that the information needed to be in “formal channels” 
and instructed Martin and Robin to include the Minneapolis FBI and 
appropriate Legat offices on the teletype so that the offices would know what 
FBI Headquarters was doing. Martin replied that he had spoken to Craig about 
the lack of a formal request and that Martin had begun preparing a teletype, but 
that he had not yet completed it. 


On the same day, in an e-mail from Don to Roy in which Don 
recommended that FAA sky marshals be used to escort Moussaoui when he 
was deported to France, Don wrote that he “would also suggest that 
[Minneapolis] ensure FAA is on board (figuratively and literally). FAA needs 
to know that FBI suspects that your subject may have been up to no good 
which included his desire to obtain 747 pilot training.” Roy responded in an e- 
mail that the Minneapolis FBI was working on an LHM and would disseminate 
it to the FAA in Minneapolis as soon as possible. 
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Henry told the OIG that he began drafting an LHM to the FAA and that 
he thought it was important to inform the FAA that Minneapolis believed that 
Moussaoui wanted to seize control of an airplane and that he might be released 
soon after he was back in France. Henry prepared a 7-page LHM in which he 
summarized the FBI’s investigation, including what the FBI had learned from 
the flight school employees about Moussaoui and his interest in and ability to 
use the mode control panel. Henry noted, “While it is not known if his 
physical training and study of martial arts are also connected to this plan, such 
preparations are consistent with facilitating the violent takeover of a 
commercial aircraft.” 


Henry also included a section at the end of the LHM labeled “threat 
assessment” in which he wrote: 


Minneapolis believes that Moussaoui, Al-Attas, and others 
not yet known were engaged in preparing to seize a Boeing 
747-400 in commission of a terrorist act. As Moussaoui denied 
requests for consent to search his belongings and was arrested 
before sufficient evidence of criminal activity was revealed, it is 
not known how far advanced were his plans to do so. 


Henry wrote that the French authorities were planning to receive Moussaoui 
into custody when he was deported and would search his belongings, but that it 
was not known whether he could be detained over the long term. Henry added 
that “most significantly” it was unknown whether the French authorities would 
be able to retain Moussaoui’s property indefinitely, including the flight 
manuals and “materials believed to be contained on his laptop which pertain to 
his plan.” Henry wrote that if the materials were returned to Moussaoui and he 
was released, “Moussaoui may have the ability to continue with his plan to 
utilize a 747-400 for his own ends.” Henry added, “As the details of his plan 
are not yet fully known, it cannot be determined if Moussaoui has sufficient 
knowledge of the 747-400 to attempt to execute the seizure of such an aircraft 
if he becomes free to do so in the future.” 


On September 4, Gary discussed this LHM with Martin. According to 
Gary’s notes of the conversation, Martin told him not to provide the LHM to 
the FAA because FBI Headquarters was issuing a teletype that day to all 
agencies. Martin instructed Gary to provide the local FAA office with a copy 
of the teletype once it was received in Minneapolis. 


175 


Martin’s 11-page teletype was issued on September 4. It was addressed 
to the FBI Minneapolis and Oklahoma City offices, six FBI Legat offices, the 
CIA, FAA, Department of State, INS, U.S. Secret Service, and U.S. Customs 
Service. The teletype consisted of a summary portion and the details of the 
Moussaoui investigation. In the summary portion of the teletype, Martin wrote 
that Moussaoui had been detained on a visa waiver overstay violation after he 
was brought to the attention of the FBI by instructors at the Minneapolis flight 
school, who had become suspicious of him because he was taking flight 
simulation training for a 747-400 aircraft. The teletype stated that this training 
is normally given to airline pilots, and that Moussaoui had no prior experience 
and had paid $8,300 in cash for the course. The teletype included the 
information received from the French authorities about Moussaoui, including 
that he adhered to radical Islamic fundamentalist beliefs and he had recruited a 
person to join the jihad against Russian forces in Chechnya. It also included 
the later information received from the French, such as the description of him 
as “full of hatred and intolerance and completely devoted to the Wahabite 
cause” and that he was “considered to be potentially very dangerous because of 
his beliefs and the nature of his character.” The teletype added that Moussaoui 
had traveled to Pakistan for two months prior to his arrival in the United States 
and that “it is noted that Islamic extremists often use Pakistan as a transit point 
en route to receiving training at terrorist camps in Afghanistan.” 


After the summary portion of the teletype, Martin included specifics from 
the investigation, most of which were taken from the 26-page EC prepared by 
Henry at the initiation of the investigation. Unlike the LHM Henry had 
prepared to give to the FAA, however, the teletype did not contain a threat 
assessment or any indication that the Minneapolis FBI believed that 
Moussaoui, Al-Attas, and others not yet known were engaged in preparing to 
seize an airplane in commission of a terrorist act. 


On September 5, Henry and an INS agent provided Martin’s teletype to 
the FAA office in Minneapolis and briefed FAA employees on the threat that 
the Minneapolis FBI believed Moussaoui posed. Henry told the OIG that 
while the teletype contained most of the facts of the investigation, it lacked 
conclusions and analysis and had “no statement of opinion as to the threat that 
this represents.” 


Martin told the OIG that at the time that he was preparing the teletype, he 
was not aware that the Minneapolis FBI was preparing an LHM to provide to 
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the local FAA office. He stated that he discussed to whom to address his 
teletype with the IOS at FBI Headquarters who prepared teletypes for the FBI 
when it disseminated threat information, and he also discussed the contents of 
the teletype with an FAA employee detailed to FBI Headquarters. Martin told 
the OIG that he included in the teletype what he believed was supported by the 
facts of the investigation. He asserted that Minneapolis had a “gut feeling” that 
Moussaoui was “up to no good,” but did not have intelligence information of 
an ongoing plot or plan to hijack an airplane. 


Don told the OIG that the FBI used teletypes to disseminate facts 
gathered from an investigation and to disseminate information about threats. 
He said that Martin’s teletype was a compilation of the facts and did not 
“speculate as to what Moussaoui was up to.” Don said that the FBI anticipated 
that the recipient agencies would provide the FBI with their reactions to the 
teletype or information that was relevant to the teletype. 


I. September 11 attacks 


On September 10, Henry received an e-mail from Carol, the FBI 
Headquarters employee whom he had contacted for more information about 
Khattab’s connections to Al Qaeda. She asked whether Henry had ever 
received anything that he could use in support of a search warrant for 
Moussaoui’s belongings. Henry responded that the RFU had determined that 
Minneapolis had insufficient evidence to pursue either a FISA or a criminal 
warrant. He noted that Minneapolis “did not pursue this further because [FBI 
Headquarters has] directed that this is an INS matter.” He added that he 
“strongly disagree[d].” He also wrote that Moussaoui was being deported to 
France and that his “big fear” was that Moussaoui would be released following 
his deportation. He concluded by thanking Carol for her assistance. 


Carol responded a few minutes later by e-mail in which she wrote, 
“Thanks for the update. Very sorry that this matter was handled the way it was, 
but you fought the good fight. God Help [sic] us all if the next terrorist 
incident involves the same type of plane.” 


On the morning of September 11, at 8:34 a.m. Eastern Standard Time, 
Martin sent an e-mail to Gary finalizing plans for Moussaoui’s deportation, 
which the FBI believed would occur within several days. Just 12 minutes later, 
the first hijacked airplane hit the north tower of the World Trade Center. 
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After the first airplane hit, Martin tried to call Minneapolis ASAC 
Charles but reached Rowley instead. According to Rowley, she told Martin 
that it was essential to get a criminal search warrant for Moussaoui’s 
belongings. Rowley said that Martin instructed her that Minneapolis should 
not take any action without FBI Headquarters approval because it could have 
an impact on matters of which she was not aware. In her May 20, 2002, letter 
to the FBI Director, Rowley wrote that in this conversation with Martin she had 
said “in light of what just happened in New York, it would have to be the 
‘hugest coincidence’ at this point if Moussaoui was not involved with the 
terrorists.” Rowley wrote that Martin replied “something to the effect that I 
had used the right term ‘coincidence’ and that this was probably all just a 
coincidence.” Rowley told the OIG that she agreed to follow Martin’s 
directive not to immediately seek a criminal warrant, and she was told that FBI 
Headquarters would call her back. 


Martin told the OIG that he recalled that there was a lot of confusion 
when he spoke to Rowley. Martin said that he did not recall making the 
statement about a coincidence to Rowley. He explained to the OIG that he did 
not feel comfortable giving legal advice about seeking a criminal warrant, so 
he went to the NSLU attorney who we call Tim, who advised that the 
Minneapolis FBI should seek the criminal search warrant. 


While Rowley was waiting for a return call from FBI Headquarters, 
Minneapolis ASAC Charles was on the telephone with Don. Because Acting 
SAC Roy was out of the office, Charles was responsible for the Minneapolis 
office and had called FBI Headquarters immediately after the first airplane hit 
the World Trade Center. Charles had reached Don and asked him for 
permission to seek a criminal search warrant for Moussaoui’s belongings. 
According to Charles, Don responded that he still did not believe that there was 
enough evidence to support a criminal search warrant. Charles stated that, 
during the course of this conversation the Pentagon was hit by another hijacked 
airplane, and that Don then told Charles to go to the USAO for a criminal 
warrant. 


Don confirmed that he spoke to Charles on the morning of September 11. 
He asserted that he immediately told Charles that the Minneapolis FBI could 
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seek a criminal warrant.’ Don told the OIG that it was a brief conversation 
that lasted several seconds at the most. 


Once Don authorized contact between the Minneapolis FBI and the 
Minneapolis USAO, Henry and Rowley went to the USAO to obtain a criminal 
search warrant for Moussaoui’s belongings. They consulted with several 
senior Assistant United States Attorneys, and drafted an affidavit in support of 
the search warrant. The affidavit stated that there was probable cause to 
believe that the laptop computer and other items seized from Moussaoui would 
contain evidence of a violation of 18 U.S.C. § 32 — destruction of aircraft or 
aircraft facilities. The affidavit contained much of the information reported in 
Henry’s 26-page EC about Moussaoui’s interactions with the flight school and 
interviews with the Minneapolis FBI, as well as the information from Al-Attas’ 
will and from the transcribed conversation of Al-Attas while he was in custody. 
The affidavit also included information about the September 11 attacks on the 
World Trade Center and the Pentagon. The search warrant was granted that 
day. 


The FBI searched Moussaoui’s belongings that were being held at the 
INS offices in Minnesota, including the laptop computer, associated computer 
software such as diskettes, spiral bound notebooks, clothes, and a cellular 
telephone. The return from the search warrant stated that the following items, 
among other things, were found: a pair of shin guards; a Northwest Airlines 
747 cockpit operating manual; two 747 training videos; seven spiral notebooks 
containing handwritten notes about aviation; a Microsoft flight simulator book; 
a PowerPoint compact disc; a cell phone; binoculars; headphones; a skullcap; a 
cassette recorder; European coins; eyeglasses; disposable razors; and several 
documents, including financial records, blank checks, and identification papers 
from France. 


Moussaoui’s belongings did not reveal anything that specifically provided 
a warning or an indication of an imminent terrorist attack. There were no plans, 
correspondence, or names or addresses in his computer or notebooks that linked 
him directly to the September 11 terrorist attacks. However, information was 


142 The 1995 Procedures provided that the FBI could go directly to the USAO without 
obtaining permission from the Criminal Division if “exigent circumstances” were present. 


179 


obtained in the search that, through further traces, was used by the government 
to indict Moussaoui for conspiring in the September 11 terrorist plot. 


J. Information received from British authorities on September 12 
and 13 


On September 11, after the attacks, the London Legat again requested 
information about Moussaoui from the British. According to British reports 
that the FBI reviewed on September 12 and 13, Moussaoui had attended an al 
Qaeda training camp in Afghanistan. 


It is not clear why the information from the British was not provided to 
the FBI until after September 11. The FBI’s ALAT in London first contacted 
the British authorities by telephone and in a written communication dated 
August 21. The ALAT summarized the status of the FBI’s investigation of 
Moussaoui, provided a document describing the results of the investigation at 
that time, and asked for traces to be conducted on Moussaoui and all of the 
individuals listed in his communication and in an enclosed document. 


The ALAT told the OIG that he had had several meetings and telephone 
calls with the British authorities in which Moussaoui was discussed. He said 
that the British were well aware of the importance of the matter. In addition, he 
said that on September 5 he provided the British with the additional information 
about Moussaoui that the FBI had received from the French authorities. The 
ALAT told the OIG that he did not know why the British authorities failed to 
provide the information about Moussaoui sooner. However, he said that 10 to 15 
days to respond to a request for information from the FBI was normal. 


K. Moussaoui’s indictment 


On December 11, 2001, Moussaoui was indicted by a grand jury on six 
conspiracy counts directly related to the September 11 attacks. He is still 
awaiting trial. ® 


143 On July 22, 2002, Al-Attas pled guilty to making false statements to federal 


investigators. He was sentenced on October 22, 2002, to time served. 
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III. OIG Analysis 


We concluded that there were significant problems in how the FBI 
handled the Moussaoui case. In our view, these problems were attributable to 
both systemic issues in how the FBI handled intelligence and counterterrorism 
issues at the time, as well as to individual failings on the part of some of the 
individuals involved in the Moussaoui case. 


A. No intentional misconduct 


At the outset of our analysis, we believe it is important to state that we 
did not conclude that any FBI employee committed intentional misconduct, or 
that anyone attempted to deliberately “sabotage” the Minneapolis FBI’s request 
for a FISA warrant, as Rowley wrote in her letter to FBI Director Mueller. For 
example, Rowley argued that Martin edited the initial FISA request submitted 
by the Minneapolis FBI and omitted information to “deliberately further 
undercut the FISA effort.” Rowley also suggested that as part of the alleged 
sabotage, FBI Headquarters personnel failed to make Minneapolis aware of the 
Phoenix EC. 


As we discuss below, we believe that Rowley’s letter raised significant 
problems in the way the Moussaoui investigation was handled, and we criticize 
some of the actions of FBI employees. Her letter also alluded to broader 
problems that existed in how the FBI handled intelligence matters and FISA 
requests. But contrary to her assertions, we found no evidence, and we do not 
believe, that any FBI employee deliberately sabotaged the Moussaoui FISA 
request or committed intentional misconduct. 


B. Probable cause was not clear 


Rowley asserted in her letter that FBI Headquarters inappropriately failed 
to seek a FISA warrant even though probable cause for the FISA became clear 
when the FBI received the French information that Moussaoui had recruited 
someone to fight in Chechnya on behalf of the rebel forces led by Ibn Khattab. 
As we discuss below, in our view the standards that the FBI applied towards 
FISA requests before September 11 were unduly conservative, and FBI 
Headquarters did not fully or appropriately analyze the French information, as 
well as other pieces of information regarding Moussaoui, for how it could be 
used in the FISA process or in connection with obtaining a criminal warrant. 


181 


But according to the prevailing FBI and DOJ practices at the time, it was 
not clear that the French information, or other available information, was 
sufficient to obtain a warrant from the FISA Court. Prior to September 11, 
2001, the Chechen rebels led by Khattab had not been designated by the State 
Department as a foreign terrorist organization. FBI managers and attorneys we 
interviewed told us that they believed that the Chechen rebels had not been 
pleaded as a foreign power before the FISA Court previously. In addition, they 
stated that while it may have been theoretically possible to use the Chechen 
rebels as a new foreign power in FISA applications to the FISA Court, FBI 
Headquarters was operating under the belief that OIPR would not plead a 
foreign power in a FISA request that had not previously been pled. In addition, 
several FBI witnesses stated that the intelligence at the time suggested that 
Khattab and the Chechen rebels were involved only in a civil war and were not 
interested in harming U.S. interests, and they believed this assessment would 
have caused OIPR not to support using the Chechen rebels as a foreign power 
in a FISA application. The FBI witnesses stated that even if the CIA had 
evidence that would have supported articulating the Chechen rebels as a 
foreign power for a FISA application, “building” a new foreign power for a 
FISA application was a process that took several months to complete, and the 
Moussaoui FISA warrant was needed more quickly because he was about to be 
deported. 


The Minneapolis FBI believed that the foreign power connection was 
also established because Moussaoui was connected to Khattab, who was linked 
to Usama Bin Laden. Yet, several FBI employees we interviewed stated that 
while there was some association between Khattab and Bin Laden, the latest 
intelligence information indicated Khattab was not part of the al Qaeda 
organization, and that Khattab did not take direction from Bin Laden. 


In an effort to examine whether probable cause was clear with regard to 
the Minneapolis FBI’s request for a FISA warrant, we asked James Baker, the 
current head of OIPR, to review the documentation in the Moussaoui 
investigation and provide us with his assessment as to whether there was a 
sufficient connection between Moussaoui and a foreign power to support a 
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FISA warrant. He opined that the case for a FISA warrant was “not a slam 
dunk” and that there were “no conclusively damning facts” to establish the 
necessary connection to a foreign power. However, he said that, while he 
could not say conclusively how he would have responded if he had been asked 
to review the Moussaoui matter in August 2001, he thought it might have been 
possible to argue that Moussaoui and the other individuals who had surfaced in 
the investigation were operating as an al Qaeda cell in the United States. 
Alternatively, he said that it was possible to argue that Moussaoui, Al-Attas, 
and the other individuals who surfaced in the investigation were their own 
small, unnamed foreign power, since the FISA legislative history provides that 
a foreign power can be a group as small as two individuals. 


Baker stated that if the request for a FISA warrant had been presented to 
OIPR for consideration in August 2001, he would have “asked lots of 
questions” about it. He said that he would have been concerned about such a 
FISA application because the Minneapolis FBI had at first wanted to go to the 
U.S. Attorney’s Office to seek a criminal search warrant, and he believed this 
would have raised questions with the FISA Court that the FBI was trying to use 
FISA to pursue a criminal investigation. He said that in order to obtain a FISA 
warrant, OIPR likely would have recommended a wall between the two 
investigations. 


Baker’s analysis confirmed our view that, contrary to Rowley’s 
allegations, the Minneapolis FBI did not have a completely clear case for a 
FISA warrant in the Moussaoui case that would have been easily approved had 
the FBI and OIPR sought one from the FISA Court. Given the standards and 
prevailing practices at the time, FBI Headquarters’ assessment that it could not 
establish Moussaoui’s connection to a foreign power with OIPR or the FISA 
Court was not completely off base, as alleged by the Minneapolis FBI. Nor do 
we believe that FBI Headquarters’ failure to seek a FISA warrant was a result 
of any intent to “sabotage” the Moussaoui case. But, as we discuss below, we 


144 As stated previously, Baker joined OIPR in October 1996 and became the Deputy 


Counsel in 1998. In May 2001, he was named Acting Counsel, and in January 2002 he 
became the Counsel. Before we showed him the documents, Baker had not previously 
reviewed the Moussaoui information. 
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believe the FBI Headquarters’ handling of the Moussaoui request and other 
FISA requests was unduly conservative and problematic in various ways. 


C. Problems in the FBI’s handling of the Moussaoui investigation 


The handling of the Moussaoui case highlighted that the Department’s 
narrow interpretation of the “purpose” requirement under FISA before 
September 11, 2001, was a severe impediment to obtaining FISA warrants. 
We also question how the FBI examined the interaction between a potential 
criminal case and an intelligence case in the context of the Moussaoui 
investigation. 


We believe the FBI did not carefully consider its options at the outset of 
the Moussaoui investigation, and it inexplicably failed to consider whether it 
should seek a criminal warrant once the decision was made that a FISA warrant 
should not be sought. Moreover, it did not adequately disseminate, within or 
outside the FBI, the information from the Minneapolis FBI about the potential 
threat posed by Moussaoui. 


The Department’s interpretation of FISA was conservative prior to 
September 11 for a variety of reasons. This conservative interpretation was 
exacerbated in the Moussaoui case by the fact that many of the FBI’s decisions 
were informed only by what FBI Headquarters or NSLU attorneys sensed 
might be the reaction of OIPR or the FISA Court. There was no clear body of 
law to guide the FBI, and neither OIPR, the NSLU, nor FBI management made 
clear the policies and practices to guide individual FBI employees or 
supervisors on FISA applications. Many decisions appear to have been made 
based on prior feedback from OIPR, rather than clear guidance. As we discuss 
below, this lack of guidance resulted in frequent misunderstandings about the 
possibilities under FISA or the appropriate standards to guide decisions 
regarding intelligence and criminal investigations. 


1. Initial evaluation of the request for a FISA warrant 


a. Prevailing standards 


As discussed in Chapter Two, the FISA statute requires that “the 
purpose” of a FISA warrant be to obtain foreign intelligence information. 
However, courts and the Department for many years used the standard of 
whether the “primary purpose” of the FISA request was to obtain intelligence 
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information. Under this standard, the Department and the FBI analyzed each 
case to determine whether the goal of an investigation was to gather 
intelligence or to pursue a criminal investigation. In 1995, the Department 
developed written procedures, called the “1995 Procedures,” designed to 
ensure adherence to this “primary purpose” standard. The impetus for the 1995 
Procedures was OIPR’s concern that the lack of procedures had permitted the 
FBI and the Criminal Division to work so closely together in the Ames case 
that the FISA Court would believe that the purpose of the FISA warrant was to 
gather information for the criminal case, rather than the intelligence 
investigation. 


The Department’s interpretation of the primary purpose standard, and the 
widespread perception within the FBI that the FISA Court and OIPR would not 
permit criminal investigative activity when an intelligence investigation was 
opened, impeded the Minneapolis FBI’s ability even to consult with 
prosecutors to assess whether probable cause existed to obtain a criminal 
search warrant. After Moussaoui’s arrest on immigration charges, the 
Minneapolis FBI wanted to search Moussaoui’s belongings to determine his 
plans and to prevent him from committing a terrorist act. The FBI agents’ 
objectives were broad — to deter any criminal activities, to protect national 
security by whatever means available, and to obtain any intelligence on 
Moussaoui’s plans. These objectives could not be easily categorized as either 
criminal or intelligence. 


Unfortunately, under the prevailing standards at the time, consultation 
and coordination with the prosecutors in the local U.S. Attorney’s Office was 
difficult, and it did not occur in the Moussaoui case. The Minneapolis agents 
opened the Moussaoui case as an intelligence investigation. As a result, they 
could not contact the USAO for guidance and advice on the criminal 
investigation or the possibility of obtaining a criminal search warrant without 
approval from the Criminal Division and notice to OIPR. Once the FBI’s 
intelligence case was opened, FBI Headquarters had to send a memorandum to 
the Criminal Division to receive permission to contact the USAO to discuss a 
criminal warrant. 


The Minneapolis FBI initially made contact with the USAO, but then did 
not pursue any substantive conversations because of these prohibitions. 
Conversely, if the Minneapolis FBI had opened the case as a criminal 
investigation, or consulted with the USAO or the Criminal Division attorneys 
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about a criminal case, that possibly would have affected its ability to obtain a 
FISA warrant because of concerns about the “smell test.” According to OIPR 
Counsel Baker, even the fact that that Minneapolis FBI had written in its 
26-page EC that it wanted permission to go to the USAO would have been 
something that concerned him and may have affected the Moussaoui FISA 
request. 


At the initial stages of a terrorism investigation, it is often unclear and 
difficult to know how to proceed. In this case, the Minneapolis agents were not 
able to seek advice directly from the Minneapolis USAO, which was probably 
in the best position to assess whether there was sufficient evidence to obtain a 
criminal warrant from the local court. Although Rowley assumed that the 
Minneapolis USAO would not have supported the request for a criminal 
warrant because she believed it had an unduly high standard of probable cause, 
this was only a guess. The Minneapolis USAO disputes her claim and stated 
that its normal practice was to work with the FBI to obtain a warrant. Yet, 
whether or not this assessment was accurate, the system resulted in uninformed 
decisions because it did not allow agents to consult with prosecutors at an early 
stage, absent permission from the Criminal Division.'® 


This problem was addressed in October 2001, when the Patriot Act 
changed the requirement from “the purpose” (for obtaining foreign 
intelligence) to “a significant purpose,” and specifically permitted such 
consultations. As a result, direct consultations among the intelligence 
investigators and the criminal investigators and prosecutors can occur 
immediately. We agree with the statement of former Associate Deputy 
Attorney General David Kris, who testified before Congress on September 10, 
2002: 


We need all of our best people, intelligence and law 
enforcement alike, working together to neutralize the threat. In 
some cases, the best protection is prosecution — like the recent 


145 Tn addition, as discussed in Chapter Two criminal investigations had to be segregated 


from intelligence investigations, and information collected in the intelligence investigation 
that related to the criminal investigation had to be passed “over the wall” to the agents 
handling the criminal investigation. We discuss some of the problems created by this 
system in Chapter Five. 
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prosecution of Robert Hanssen for espionage. In other cases, 
prosecution is a bad idea, and another method — such as 
recruitment — is called for. Sometimes you need to use both 
methods. But we can’t make a rational decision until everyone 
is allowed to sit down together and brainstorm about what to do. 


(Emphasis in original.) 


b. Inadequate evaluation of whether to proceed as a 
criminal or intelligence matter 


Given the effect that consulting with the USAO had on a potential FISA 
application, the options in the Moussaoui case needed to be evaluated carefully 
before making the initial decision whether to proceed criminally or as an 
intelligence investigation under FISA. This was especially true because the 
Moussaoui case was unusual for the FBI. Ordinarily, the FBI spent months 
collecting intelligence information in support of a FISA request. However, in 
this case the FBI did not have time because Moussaoui was about to be 
deported. 


Therefore, it was even more important for the FBI to carefully consider 
the evidence before it, the likely outcome of seeking a criminal warrant, 
including an assessment of probable cause for a criminal search warrant, and 
the potential for obtaining additional information that could connect Moussaoui 
to a foreign power under the FISA standards at the time. 


Unfortunately, this careful or thorough analysis did not occur. After 
initially opening the Moussaoui matter as an intelligence investigation, the 
Minneapolis FBI agents requested FBI Headquarters to seek permission from 
the Criminal Division to approach the USAO to discuss a criminal warrant. 
Because of its relative inexperience in handling counterterrorism 
investigations, the Minneapolis FBI did not appreciate the adverse impact that 
seeking a criminal warrant could have on the intelligence investigation. 
Therefore, as an initial matter it did not fully consider the issues and outcomes 
in pursuing the Moussaoui case as an intelligence investigation or criminal 
investigation. By the same token, it did not receive sufficient guidance or 
assistance from FBI Headquarters, partly because of the strained relations 
between the Minneapolis Field Office and the RFU, which we discuss below. 
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Another opportunity for a thorough assessment of the case arose when 
the Minneapolis case agent, Henry, consulted with RFU Unit Chief Don. Don 
advised Henry that he did not believe that there was sufficient information to 
obtain a criminal search warrant and that failing to obtain a criminal search 
warrant would prevent the Minneapolis FBI from obtaining a FISA search 
warrant. Henry’s recollection is that Don directly told him that he could not 
open a criminal case. According to Henry, Don also asserted that probable 
cause for a criminal search warrant was “shaky.” After his conversation with 
Don, Henry wrote on the paperwork that had been previously prepared to open 
the criminal case: “Not opened per instructions of [Unit Chief Don].” 


Don told the OIG, on the other hand, that he did not give such a direct 
instruction and that at no time did he tell Minneapolis that they could not 
pursue the matter criminally. He said that based on his knowledge of the case, 
he did not believe there was criminal predication for a criminal search warrant 
and that he voiced this opinion to the Minneapolis FBI about the lack of 
criminal predication. He said he also advised Minneapolis that if obtaining the 
criminal warrant failed, the FBI would not be able to pursue the FISA warrant. 
Don said he suggested the case agent consult with the Minneapolis CDC, 
Coleen Rowley, about whether she believed that probable cause for a criminal 
search warrant was present because he believed that it was the role of the CDC 
to make such assessments. According to Don, he stated, “you guys need to go 
back to your CDC, you need to discuss it with your CDC, and get back to me 
and tell me your position.” As we discuss below, Henry did consult with 
Rowley, who said she recommended the avenue with the best chance of 
success, which she believed was seeking a FISA warrant instead of a criminal 
warrant. 


While it is impossible to be certain of what exactly was said in the 
discussion between Don and Henry, or whether FBI Headquarters made clear it 
would refuse permission to seek a criminal warrant, it is clear that the decision 
on whether to pursue a criminal or intelligence case was made without full 
consultation or adequate analysis. Based on this conversation and other 
contacts with Martin and Don in the following days, Minneapolis believed that 
FBI Headquarters would not support its request to seek a criminal warrant and 
that a FISA request was the only viable option available. It therefore pursued 
that option. But no one carefully considered at an early stage whether this was 
likely to be a viable option under the prevailing FISA standards. 
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We do not believe that Don’s response to Henry’s initial contact was 
adequate. Don should have weighed the possibility of obtaining a criminal 
warrant with what would be gained from the intelligence investigation and the 
problems in obtaining a FISA warrant. While Don believed that the 
Minneapolis FBI lacked sufficient information to warrant pursuing a criminal 
investigation and that the intelligence investigation was therefore the only 
option available, this judgment was made too quickly and without adequate 
consideration of whether the evidence suggested that the FBI was likely ever 
going to be able to, under the prevailing view of FISA requirements at the time, 
sufficiently connect Moussaoui to a foreign power for a FISA warrant. 


We also believe that Don should have ensured that Henry discussed the 
matter fully with RFU SSA Martin and an NSLU attorney, taking into 
consideration the potential of the criminal investigation and the potential of the 
FISA route, including the problems that would have to be overcome, before 
reaching the decision on which route to take. While it was the field office’s 
prerogative to decide how to pursue an investigation, the role of FBI 
Headquarters was to ensure that these decisions were made with full 
information and adequate analysis from the substantive experts in FBI 
Headquarters. Yet, this never occurred, partly because of Headquarters’ 
dismissal of the Minneapolis FBI’s assessment of the threat posed by 
Moussaoui, partly because of strained relations between the RFU and the 
Minneapolis FBI, and partly because FBI Headquarters approached this case 
like other cases, where there was time to investigate further and obtain more 
evidence to support the FISA warrant. In this case, however, Moussaoui was 
going to be deported quickly, and there was little time to conduct an 
investigation to obtain sufficient evidence to link Moussaoui to a recognized 
foreign power. 


From our review, early on the RFU appears to have discounted the 
concerns of the Minneapolis FBI about Moussaoui. Don and Martin believed 
that Minneapolis was overreacting and couching facts in an “inflammatory” 
way to get people “spun up” about someone who was only “suspected” of 
being a terrorist. The RFU downplayed and undersold the field office’s 
concerns about Moussaoui, even writing “that there is no indication that either 
[Moussaoui or Al-Attas] had plans for nefarious activity.” In response to the 
Minneapolis FBI’s concern that it wanted “to make sure Moussaoui doesn’t get 
control of an airplane to crash it into the [World Trade Center] or something 
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like that,” Martin dismissed this possibility, stating “You have a guy interested 
in this type of aircraft. That is it.” As we discuss below, we believe that the 
RFU did not fully consider with an open mind the evidence against Moussaoui 
and examine in a collaborative fashion with Minneapolis how to best pursue its 
investigation. Rather, it quickly and inappropriately dismissed Minneapolis’ 
information as incomplete and its concerns as far-fetched. 


However, it is also important to note that another potential opportunity 
for a thorough evaluation of both the criminal and intelligence investigations 
arose when Henry consulted with Rowley, the Minneapolis CDC. When 
Henry approached Rowley at Don’s suggestion to discuss whether Minneapolis 
should seek a criminal warrant or a FISA warrant, Rowley correctly advised 
Henry about the existence of the smell test and the adverse effect that seeking a 
criminal warrant could have on the intelligence investigation. Her advice — 
that Henry instead seek a FISA warrant — was based on her concerns that the 
USAO would not approve a request for a criminal warrant because she 
believed it used a standard higher than probable cause. Rowley told the OIG 
that she gave the advice that she believed would optimize the Minneapolis 
FBI’s chances of being able to search Moussaoui’s belongings. She did not, 
however, adequately assess or discuss with Henry whether a FISA warrant 
would even be feasible in this case, given the need to connect Moussaoui to a 
foreign power. 


Rowley acknowledged to the OIG that her experience and knowledge of 
FISA were not extensive.'“° We believe that she should have recognized the 
need for a more thorough examination of the potential of both the criminal and 


146 When we questioned Rowley about the basis for her belief that probable cause for a 


FISA warrant was “clear” when the information from the French was received, her 
responses indicated that she did not fully understand the statutory requirements of FISA. 
She believed that sufficient information existed to obtain a FISA warrant because she 
believed the French information indicated that there was probable cause to believe that 
Moussaoui was engaged in terrorist activities. Rowley failed to consider whether there was 
probable cause to believe that Moussaoui was an agent acting for or on behalf of a foreign 
power. She further stated her belief that the foreign power connection could be made to Bin 
Laden because Moussaoui shared similar philosophy and goals with Bin Laden and was 
linked to Khattab, who also held radical Islamic beliefs. These statements revealed a lack of 
a full understanding of agency principles under the existing FISA requirements. 
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intelligence options, including the likelihood of obtaining a FISA warrant 
within a matter of several days, and at a minimum consulted with an NSLU 
attorney. 


2. Failure to reconsider criminal warrant 


We found it even more troubling that after the FBI Headquarters 
conclusion — based upon NSLU advice — that Moussaoui did not have a 
sufficient connection to a recognized foreign power for a FISA warrant, no one 
reconsidered whether to try to obtain a criminal warrant. As far as we could 
determine, neither FBI Headquarters nor the Minneapolis FBI initiated any 
discussion about pursuing the criminal warrant after NSLU Unit Chief 
Bowman opined that a FISA warrant was not feasible. After the FISA warrant 
was ruled out, the “smell test” was no longer a consideration. The FBI could 
have consulted with the Minnesota USAO at that point to determine whether it 
believed there was sufficient probable cause to obtain a criminal search 
warrant. If the Minnesota USAO agreed, one could have been sought. If the 
USAO disagreed, this consultation would have had no impact on a FISA 
warrant, since one was no longer being sought. 


We asked Don, Henry, Rowley, Gary, and Martin why a criminal warrant 
was not considered after the FISA route was exhausted. Don, Henry, and 
Rowley told the OIG that they did not know why this was not done. Don said 
that looking back on the matter now, he wished it had been discussed. Gary 
told the OIG that he did not seek to pursue it again because he believed FBI 
Headquarters was not willing to support obtaining the requisite permission to 
approach the USAO. Martin told the OIG that because Minneapolis believed 
that there was sufficient evidence to support obtaining a criminal warrant, it 
was up to the field office to initiate pursuit of the criminal warrant. 


We found it puzzling, and troubling, that no one discussed pursuing this 
option. It also showed that the FBI never fully evaluated the potential of the 
criminal investigation versus the FISA investigation. Instead, the FBI pursued 
the case as an either/or proposition, without evaluating the potential of each 
approach. 


We also do not agree with Martin that it was Minneapolis’ responsibility 
alone to consider this option. In our view, his position reflects the breakdown 
in communication between Headquarters and the field, and also shows a 
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troubling lack of initiative and acceptance of responsibility by FBI 
Headquarters. While we cannot say whether a request for a criminal warrant 
would have been successful, it should have been reconsidered. 


3. Conservatism with respect to FISA 


The handling of the Moussaoui case also highlighted the conservatism of 
the Department and the FBI at the time with regard to the use of FISA. At the 
time of the Moussaoui investigation there was a widespread perception in the 
FBI that OIPR was excessively restrictive in its approach to obtaining FISAs. 
The perception was that OIPR would not plead “new” foreign powers — foreign 
powers that had not previously been pled to the FISA Court — and that OIPR 
required more support to go forward than the probable cause that what was 
required by the FISA statute. This perception caused the FBI to be less 
aggressive in pursuit of FISA warrants that did not fit the standard pattern. 


This perception was discussed in the May 2000 report of the Attorney 
General’s Review Team (AGRT) that was established to review the FBI and 
the Department’s handling of the Wen Ho Lee FCI investigations and FISA 
application. The report stated that in interviews with FBI personnel, “a 
consistent theme that has emerged has been the FBI’s substantial frustration 
with what it perceives to be OIPR’s general lack of aggressiveness in the 
handling of FISA applications.” The AGRT concluded that OIPR was too 
conservative in its handling of the Lee FISA application and three factors 
suggested that the FBI’s general complaint of undue conservatism had merit. 
First, the AGRT found that OIPR had never had a FISA application turned 
down by the FISA Court and that “this record suggests the use of ‘PC+’ 
[probable cause plus], an insistence on a bit more than the law requires.” 
Second, the AGRT asserted that while some disputes between agents and 
lawyers were to be expected, the fact that the complaints about OIPR came 
from all levels within the FBI as well as the frequency and the intensity of the 
complaints suggested that this concern was not arising out of the normal 
tension between agents and lawyers. Third, the AGRT stated that OIPR 
applied too conservative an approach to the Lee application, which suggested it 
did so across the board because of the significance of and attention received 
within OIPR by the Lee application. 


We heard similar complaints from FBI Headquarters managers and 
NSLU attorneys that OIPR was too conservative. FBI employees made two 
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arguments in support of this assertion. First, FBI employees said that OIPR 
required more than what FBI employees believed was necessary under FISA to 
get a FISA warrant. One former unit chief told the OIG that OIPR’s standard 
for probable cause was “too high.” The former head of NSLU told the OIG 
that OIPR attorneys often asked for details about the investigation that were not 
related to the issue of probable cause. He asserted that, by comparison, 

Title III applications were “far cleaner and far more succinct” than the FISA 
applications. As an example of OIPR’s conservatism, another NSLU attorney 
asserted to the OIG the fact that in FISA applications involving a particular 
terrorist organization as the foreign power, OIPR required a substantial number 
of pages worth of facts to support the assertion that it was a terrorist 
organization, despite the fact that this terrorist organization was designated as a 
foreign terrorist organization by the State Department. '*” 


Second, FBI employees told the OIG that they believed that OIPR was 
not aggressive in its use of FISA. They asserted that OIPR was not interested 
in pleading “new” foreign powers — foreign powers that had not previously 
been pled to the FISA Court. FBI employees told the OIG that with respect to 
each potential target, they had to identify which terrorist “box” the target fit 
into, and that OIPR was primarily interested in using a particular terrorist 
organization as the box and pleading it as the foreign power. FBI personnel 
explained to the OIG that while terrorist groups were at one time recognizable 
as a collection of individuals belonging to an organization with a well-defined 
command structure and could easily be placed in a terrorist “box,” this was no 
longer the case by the mid-90s. Instead, terrorists were often Islamic 
extremists who were not necessarily affiliated with any specific terrorist group 
and who received support from or shared the same goals with several different 
groups. To address this change in terrorism, the FBI proposed to OIPR in 1997 
and again in 2000 creating a new foreign power — which they called the 
“International Jihad Movement” — that would target these kinds of terrorists. 
According to FBI employees, the FBI presented its position to OIPR on several 
occasions, but OIPR was not receptive to this idea. By the summer of 2001, 


147 At the request of the FBI, in 2001 this information was eventually revised and 


shortened substantially. 
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however, OIPR had agreed to review documentation the FBI compiled in 
support of creating the new foreign power. 


James Baker, the Counsel of OIPR, acknowledged that OIPR had this 
reputation, but he did not believe that it was accurate. He stated that significant 
changes had occurred before September 11, 2001, as well as in the past few 
years. He said that at the time of the millennium (year 2000), the threat of 
terrorist attacks was high and OIPR was very aggressive in its use of new 
theories of probable cause, which the FISA Court approved. He said that OIPR 
attorneys — in their oversight role — asked a lot of questions of the FBI and did 
not automatically approve FISA applications, causing some frustrations in the 
FBI. He also stated that another source for the perception of OIPR within the 
FBI was the fact that field offices had no contact with OIPR, and as a result 
were not aware of the work that OIPR contributed to bolstering the FISA 
package. But he said that the FBI generally brought meritorious cases to OIPR 
and that he instructed his staff to be advocates for each application and to “pull 
the thing together and see if it can fly.” With respect to the new foreign 
power suggested by the FBI, Baker told the OIG that the FBI was requested 
repeatedly by OIPR to draft a memorandum setting forth the evidence 
supporting the existence of this new foreign power, but the FBI did not present 
any documentation to OIPR concerning this theory until after September 11, 
2001. 


In our review, it was clear to us that the perceptions about OIPR affected 
how aggressively FBI Headquarters handled requests for FISA warrants from 
the field. As we discuss below, the FBI was hesitant to plead new foreign 
powers or to plead unnamed foreign powers in FISA applications. Most FBI 


148 The OIPR Deputy Counsel, Margaret Skelly-Nolen, also told the OIG that she 
believed that the FBI’s criticism of OIPR had been “unfair.” She stated that OIPR learned 
what FISA Court judges would and would not approve based on their comments and 
questions in court sessions involving FISA applications. She stated that obtaining FISA 
orders in counterterrorism cases was “harder” than in the traditional espionage cases, 
although she acknowledged that not all of the attorneys in OIPR were “equally aggressive.” 
However, she also described OIPR as “proactive” and the FISA Court as “responsive” to the 
needs of the government. She added that the FBI knew “how to press” OIPR when the FBI 
really wanted a FISA warrant to go through. She stated that what she tried to do with FISA 
requests was determine what was the most accurate and expeditious way to plead the case. 
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employees we interviewed did not even consider the possibility of pleading 
unnamed foreign powers, and many did not even know that it was possible. In 
addition, an ongoing OPR investigation about errors in FISA applications 
increased the caution with which the FBI approached FISA. 


a. Failure to plead new foreign powers 


As discussed above, the government generally sought FISAs for subjects 
that had previously been approved by the FISA Court. As a result, at the time 
of the Moussaoui investigation, the FBI did not routinely try to plead “new” 
foreign powers or otherwise seek to use the FISA statute creatively. FBI 
Headquarters SSAs, IOSs, and NSLU attorneys evaluated cases and gave 
advice to the field offices based upon what they thought would get a FISA 
package through OIPR and to the FISA Court, not based upon what may have 
been legally possible under FISA. They therefore focused on “recognized” 
foreign powers — those that had previously been pled to the FISA Court — and 
sought evidence of direct links between the target and the foreign power. If the 
case fell outside those parameters, the FBI was not usually aggressive or 
creative in analyzing the possibilities under FISA. OIPR Counsel Baker 
confirmed that prior to September 11 it was far easier to show that someone 
was a member of an established group that was engaged in international 
terrorism, such as al Quaeda. In reviewing the Moussaoui case, he stated that 
although it was theoretically possible to allege a connection between 
Moussaoui and the Chechen rebels (because of Moussaoui’s recruitment of 
Amnay to go to Chechnya), it would have been far easier to use al Quaeda as 
the foreign power if sufficient information could be developed to support such 
a connection. 


One NSLU attorney told us that, by the summer of 2001, most of the FBI 
concerns were not necessarily about the legal sufficiency of the FISA request, 
but rather whether, as a practical matter, information could be presented to 
OIPR in such a way to get approval for presentation to the FISA Court. 
Several ITOS employees told us that because of the resistance to pleading new 
or unnamed foreign powers, a particular terrorist organization therefore was 
being used as a generic terrorist group in cases where there were doubts about 
ties to a specific group. Several analysts told us that even if the link to this 
particular terrorist organization was tangential and the subject appeared to be 
more closely aligned with other individuals or to be operating alone, they 
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would still try to link the potential target to this particular terrorist group in 
order to obtain FISA Court approval. 


Reflecting this view, Martin and Don advised Minneapolis that a 
“recognized foreign power” was required in order to obtain a FISA warrant. 
The French information about Moussaoui showed a potential link between 
Moussaoui and Khattab’s group of rebels in Chechnya. While Martin, Robin, 
and the NSLU attorneys were aware that the Chechen rebels could in theory 
constitute a terrorist organization and therefore be a foreign power under FISA, 
they did not believe this was a viable option. Their advice to the Minneapolis 
FBI that it needed to link Moussaoui to a “recognized foreign power” was 
based on their understanding that the Chechen rebels had not been pled to the 
FISA Court previously, the belief that the intelligence was lacking to support 
pleading that the Chechen rebels were a terrorist organization, and their 
concern that it would take months to build a case for a new foreign power. 


FBI employees pointed out that even if they could get a new foreign 
power approved by the Department and before the FISA Court, it was still 
significantly faster and easier to plead an already accepted foreign power. For 
foreign powers that had been pled before the FISA Court, the FBI could use 
previously drafted FISA applications, which contained language that already 
had been scrutinized and accepted. This approach required using the available 
language on the foreign power and filling in the individual facts of a case. It 
required less research and time to develop a persuasive package for OIPR and 
the FISA Court. In contrast, pleading a new foreign power required making a 
persuasive argument that would require several levels of approval from within 
the FBI and OIPR. This was a time consuming process, with an uncertain 
outcome. 


In the Moussaoui case, the available evidence showed a much more 
likely link between Moussaoui and Khattab and the Chechen rebels rather than 
a link to al Quaeda. While the FBI’s belief about the likelihood of success with 
OIPR and the time it would have taken to plead a new foreign power were 
important considerations, this potential option was never explored by FBI 
Headquarters. Most important, no one discussed it with OIPR, despite the 
Minneapolis FBI’s strong belief that Moussaoui was dangerous and its strong 
desire to seek all legitimate means to obtain access to his computer and other 
belongings. 
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b. Failure to consider pleading unnamed or unknown 
terrorist groups as a foreign power 


The FBI could have sought to plead that Moussaoui was linked to an 
“unnamed” foreign power. The legislative history of FISA states that an 
individual cannot be a foreign power, but that “[w]here two or three individuals 
are associated with one another, it might be argued that they are an 
‘association’ or an ‘entity,’ which, if the proper showing is made could be 
considered a ‘foreign power.’” OIPR Counsel Baker told us that based on this 
legislative history he believed that a foreign power could be as small as two 
people. He also told us that the foreign power does not necessarily need to 
have an agreed upon name or need to be widely known. 


No one at the FBI involved in this case considered trying to plead 
Moussaoui as an agent of an unnamed, new foreign power. If they had, it 
might have been possible to plead Moussaoui as an agent of an unnamed 
terrorist group composed of Moussaoui and a group operating in Oklahoma, 
such as Al-Attas, the persons who helped Al-Attas get out of jail, and the 
persons from whom Moussaoui indicated he received money. 


September 11 provided the impetus for the Department and the FBI to be 
far more aggressive in the use of FISA. Based upon OIG interviews and 
review of documents, we determined that the Department has shown a great 
degree of flexibility in pleading foreign powers since September 11. 


We recognize it is not readily apparent that trying to plead Moussaoui as 
an agent of an unnamed foreign power would have succeeded had it been 
pursued. But no one at the FBI even considered this option, despite 
Minneapolis’ adamant concerns about Moussaoui. Moreover, no one even 
consulted with OIPR about this option, or any other option, to see what could 
be accomplished to support the Minneapolis FBI’s investigation. 


c. Ongoing DOJ OPR investigation 


We believe that the FISA Court reprimand of the FBI and an ongoing 
DOJ OPR investigation of how FISAs were handled contributed to the FBI’s 
conservatism in seeking FISA requests. As discussed in Chapter Two, in 
September 2000, OIPR notified the FISA Court of errors in approximately 75 


197 


FISA applications.'*” In November 2000, the Office of the Deputy Attorney 
General referred the matter to DOJ OPR, and DOJ OPR opened an 
investigation. 


Beginning in October 2000, the FISA Court began to require all 
Department personnel who received FISA information in cases involving the 
terrorist group that had been the subject of the majority of the errors to certify 
that they understood “that under ‘wall’ procedures FISA information was not 
to be shared with criminal prosecutors without the Court’s approval.” 
Everyone who reviewed such FISA-derived information was required to sign 
the certification stating that they were aware of the FISA Court order and that 
the information could not be disseminated to criminal investigators without 
prior approval of the Court. After being notified of additional errors in FISA 
applications in March 2001, the FISA Court banned one FBI SSA from 
appearing before it. DOJ OPR was asked by the Attorney General to expand 
its investigation to include a review of these additional errors in FISA 
applications. 


We heard differing opinions within the FBI about how the DOJ OPR 
investigation affected FBI employees.'*° Martin told us that there was “a big 
push for accuracy” with new procedures being implemented and that there 
“were concerns that you just never know when an OPR is going to be opened 
up on you.” However, he said that the matter did not significantly impact his 
work. Don said that ITOS SSAs were upset about the DOJ OPR investigation 
and were concerned that the investigation would harm their careers and their 
ability to get other jobs within the FBI after their stint in ITOS. But Don 


' As discussed in Chapter Two, a significant number of the errors concerned 


inaccurate information in FISA applications about the “wall” procedures that had been put 
into effect to separate criminal investigations from intelligence investigations. 


150 Th her May 21, 2002, letter to the Director, Rowley wrote: “Our best real guess [for 


why Headquarters acted as it did in the Moussaoui matter]. . . is that, in most cases, 
avoidance of all ‘unnecessary’ actions/decision by FBIHQ managers (and maybe to some 
extent field managers as well) has, in recent years, been seen as the safest FBI career 
course.” She said that FBI officials who made decisions or took actions that turned out to be 
mistaken saw “their careers plummet and end. This has in turn resulted in a climate of fear 
which has chilled aggressive FBI law enforcement action/decisions.” 
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asserted that he did not believe the OPR investigation had “chilled” the efforts 
of the FBI. Robin stated that, while the OPR investigation caused FBI 
employees to be more careful about accuracy, she did not feel it had created 
any timidity in the use of FISA warrants. 


Other ITOS personnel believed that the OPR investigation and the 
increased scrutiny by the FISA Court had a bigger impact on FISA 
applications. One SSA who formerly was assigned to ITOS told us that, after 
the revelation of FISA application errors, there was a climate of fear and 
reluctance in ITOS. He stated that in 2000 and early 2001, all ITOS SSAs 
were aware that they would be held accountable for any mistakes made in 
FISA applications, even mistakes by field offices that the SSAs oversaw. He 
added that, because the SSA position in ITOS is temporary, most SSAs are 
planning to be promoted to a position in a field office. This would be difficult 
if an agent had been disciplined or was under investigation. He said that agents 
were concerned that their ability to be promoted would be adversely affected 
by any investigation into their actions. 


In addition, OIPR personnel said that the OPR investigation impacted the 
FBI’s work on FISAs. The OIPR Deputy Counsel told us that the OPR 
investigation caused repercussions that affected the entire process. She said 
that the FBI allowed a number of FISAs to expire because agents were 
concerned that they would find themselves under investigation or banned by 
the FISA Court for errors in applications. She said that she had heard agents 
comment that they are “not going to be another [the agent who was banned by 
the FISA Court].” 


We believe that the atmosphere in the FBI was affected by the OPR 
investigation and the FISA Court ban of the SSA. The added procedural 
requirements, concerns about individual liability, and the increased scrutiny of 
information in a FISA request likely caused agents to be more careful and 
sometimes become apprehensive about pursuing an unusual case or a case 
where all the facts were not immediately ascertainable. 


We also believe that this atmosphere affected Martin’s approach to FISA 
applications, including the Moussaoui matter. Indeed, in an e-mail on June 12, 
2001, Martin cautioned Henry about the rules related to FISA with regard to 
minimizing an intercepted conversation in another intelligence case: 
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While you folks may perceive me as being too critical at 
times, I need to be certain that I am representing facts and issues 
properly to DOJ and the Court. There are a few folks looking 
for scalps these days. I’m only trying to keep yours and mine 
from being removed. 


D. Assessment of probable cause 


FBI Headquarters also did not analyze the facts in their totality and too 
readily discounted individual facts when assessing the Minneapolis FBI’s 
concerns about Moussaoui. The standard for probable cause is the same for 
both FISA warrants and criminal warrants. The Supreme Court defined 
probable cause in Illinois v. Gates, 462 U.S. 213, 236-38 (1983), as whether, 
given the “totality of the circumstances” there is a “fair probability” that 
contraband or evidence of a crime will be found in a particular place. The 
Supreme Court emphasized that “only the probability, and not a prima facie 
showing, of criminal activity is the standard of probable cause.” This standard 
allows for drawing reasonable inferences from the facts and does not require 
direct evidence. 


Yet, we found that the RFU and the NSLU tended to view the facts of the 
Moussaoui case individually rather than consider the totality of those facts. 
They evaluated the Moussaoui investigation for direct evidence of Moussaoui’s 
links to a foreign power, particularly al Qaeda. While the perception at FBI 
Headquarters may have been that this was what was required by OIPR, FISA 
required only “probable cause” that a target was an agent of a foreign power. 


For example, in evaluating Moussaoui’s potential links to al Qaeda, 
Martin and Robin focused on the intelligence indicating that Khattab was no 
longer believed to be a part of the al Qaeda organization and did not take 
direction from Bin Laden. Although Martin and Robin were correct that the 
FBI lacked sufficient information to tie Moussaoui directly to al Qaeda, it does 
not appear that either of them evaluated the totality of the evidence for facts 
that would allow for reasonable inferences that there were sufficient indirect 
connections to al Qaeda. 


An example of information that could have been considered in support of 
the FISA request was the telephone conversation between Al-Attas and the 
Oklahoma imam while Al-Attas was incarcerated. In that conversation the 
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imam stated to Al-Attas, “I heard you guys wanted to go on Jihad.” Al-Attas 
immediately responded, “Don’t talk about that now.” Don stated in an e-mail 
to Minneapolis: “The Jihad comment doesn’t concern me by itself in that this 
word can mean many things in various muslim [sic] cultures and is frequently 
taken out of context.” Don told us that he saw the use of the term “jihad” all 
the time and there are always questions about what the term really means. Yet, 
while the term may be open to interpretation, it is a significant comment that in 
context should have been given greater weight in considering whether there 
was probable cause to believe Moussaoui was connected to a terrorist group. 
Baker told us that “he would have tied bells and whistles” to the jihad comment 
in a FISA application. 


Don also discounted Al-Attas’ will. He stated in an e-mail that the will 
was “interesting,” but he told the OIG that it is not uncommon for Muslims to 
have a will. However, as pointed out in the criminal search warrant obtained 
after the September 11 attacks, the will was in a mailing envelope as though it 
was ready to be sent to relatives. 


We believe that the RFU failed to appreciate the significance of these 
individual facts and failed to analyze their effect on the totality of the 
circumstances. Instead, it treated each fact individually and too readily 
discounted their significance. The end result of this approach was that all of 
the facts were never fully considered in their totality or fully presented to 
anyone for a legal sufficiency review — whether by the NSLU or OIPR. 


E. Conflict between Minneapolis and FBI Headquarters 


Many of the problems that arose in the handling of the Moussaoui case 
also were affected by strained relations between the Minneapolis FBI and the 
RFU. Prior conflicts with the RFU led the Minneapolis FBI agents to mistrust 
the judgment of the RFU, and Martin in particular. The Minneapolis FBI 
thought that the RFU was “raising the bar,” was not aggressive, and acted out 
of an abundance of caution. The Minneapolis agents also thought that the RFU 
did not support the field adequately, undervalued the Moussaoui case, and 
undermined their efforts. Minneapolis therefore was skeptical of the advice 
from Headquarters and attempted to bypass Headquarters to obtain relevant 
assistance and evidence from other agencies. 
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By the same token, the RFU mistrusted the Minneapolis FBI based on 
experience in prior matters and believed that in the Moussaoui case 
Minneapolis was proceeding from “gut feelings” rather than evidence. Martin 
and others in the RFU did not have faith in the judgment of some Minneapolis 
FBI agents, and thought they had a tendency to claim “the sky was falling.” 
The RFU also believed that Minneapolis did not adequately understand the law 
or the requirements for a FISA warrant. 


This friction — as well as the clash of personalities — resulted in poor 
communication and misunderstandings between FBI Headquarters and 
Minneapolis. The atmosphere was not conducive to, and did not lead to, the 
field and Headquarters carefully considering the best options for proceeding in 
the investigation and jointly seeking an appropriate result. Instead, both sides 
mistrusted the other and hardened in their positions. As a result, the RFU’s 
response to requests from Minneapolis and to new evidence appeared to be 
skepticism and a quick reaction that the evidence was not sufficient. This 
caused the Minneapolis FBI to believe even more strongly that Headquarters 
was undermining its efforts. The communications became increasingly 
adversarial and incomplete. 


For example, Martin advised the Minneapolis FBI that, to obtain a FISA 
warrant, it needed to connect Moussaoui to a “recognized foreign power.” This 
advice was shorthand for a foreign power that had previously been pled to the 
FISA Court. The Minneapolis agents, who were not experienced in FISA 
matters, did not understand the advice and disagreed with it. This can be seen 
in Henry’s e-mail to Gary and the Paris ALAT in which Henry wrote that the 
RFU advised that the French information was not sufficient for a FISA warrant 
because it did not connect Moussaoui to a “named group.” Henry also wrote, 
“T don’t agree. . .who said that a foreign power has to be a named group?” In 
an e-mail to the London ALAT and others, Henry wrote, “Help us establish 
that [Moussaoui] is acting on behalf of a foreign power (which RFU seems to 
think must be a named group or a country).” Had there been better 
communication between the two offices, we believe the Minneapolis FBI 
agents would have understood better why FBI Headquarters was advising the 
Minneapolis FBI that a “recognized foreign power” was needed. 
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F. Problems with legal review of FISA request 


We concluded that this case did not receive a sufficient FBI legal review. 
While the RFU consulted with several NSLU attorneys about the Moussaoui 
case, it consulted a different attorney each time. A single NSLU attorney was 
not assigned to the case, and no NSLU attorney ever reviewed all the facts or 
the documentation from the field before providing an opinion as to the 
sufficiency of the evidence to obtain a FISA warrant. 


In addition, when presenting the case to NSLU attorneys, Martin made 
clear that he did not think there was sufficient evidence for a FISA warrant and 
orally provided some facts of the case. While oral briefings and consultations 
on an ad hoc basis may have been adequate for most FBI FISA requests, it was 
not adequate in an unusual case like this one. Here, there were indications that 
Moussaoui was connected to terrorist groups, but the connection to a foreign 
power was not clear. Moreover, the time frame to obtain a warrant was 
compressed because of Moussaoui’s imminent deportation. There also was 
vehement disagreement in this case between the field office and FBI 
Headquarters about the FISA request. In light of these unusual factors, the 
NSLU should have been apprised of all of the facts, the strength of the field’s 
belief in the need for a warrant, and the depth of the field’s disagreement with 
Headquarters’ position on this case. 


Martin consulted with four NSLU attorneys about the Moussaoui FISA 
request. He gave each attorney an oral briefing on what he believed were the 
relevant facts as to whether Moussaoui was connected to a foreign power. 
Although Martin had the documents provided by the Minneapolis FBI that 
described in detail the facts of the Moussaoui investigation, he did not provide 
this documentation to any of the attorneys. The attorneys gave verbal advice 
based only on Martin’s oral presentation. No one asked whether there was 
documentation that had been generated in the case or asked to review any such 
documentation, and two told the OIG they did not believe such documentation 
existed. 


Although it is impossible to reconstruct Martin’s exact conversations 
with the NSLU attorneys, the evidence shows that Martin provided a brief 
recitation of the facts that contained less than all of the available information 
about Moussaoui. At the start of the briefings Martin also conveyed to the 
NSLU attorneys his belief that there was insufficient evidence for a FISA. He 
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did not present the request to NSLU attorneys neutrally or convey the 
Minneapolis FBI’s strong concerns that Moussaoui was likely to commit a 
terrorist act. Martin undersold the case to the attorneys and conveyed it in a 
way that did not fully present the field’s views. 


Martin had identified the issue in the Moussaoui case as the lack of a 
foreign power and said he focused on the information that he believed was 
relevant to that issue, which according to Martin was the French information 
indicating that Moussaoui had some connection to Khattab and his group of 
Chechen rebels. Because the FBI’s focus at the time was on establishing direct 
links between a potential target and a foreign power, however, Martin 
overlooked facts from which reasonable inferences might have been drawn that 
Moussaoui was involved with a terrorist group. This included Moussaoui’s 
recent travel to Pakistan and Al-Attas’ statements about Moussaoui’s radical 
fundamentalist Islamic beliefs. None of this information was provided to the 
NSLU attorneys. 


We recognize that at the time it was normal practice for SSAs and IOSs 
to give only oral briefings to NSLU attorneys and that they determined what 
information needed to be discussed with the NSLU attorney. They were not 
required to provide all of the underlying documentation to the NSLU attorneys 
with whom they were consulting, and NSLU attorneys were not required to 
read all of the underlying documentation before providing advice. But given 
the Minneapolis FBI’s urgency to obtain a warrant and the strong disagreement 
between Headquarters and the field office over whether a FISA warrant could 
be obtained, we believe that Martin should have presented the documentation 
to the NSLU attorneys to ensure that Minneapolis’ position was being 
presented fairly and completely to the NSLU. The RFU had promised the 
Minneapolis FBI that the NSLU would give the Minneapolis request a “good 
faith review,” but the RFU did not present all the documentation, or all the 
facts, to any NSLU attorney for that review. We also believe that the 
Minneapolis FBI should have been asked to participate in the discussions with 
the NSLU, partly to ensure that its views were conveyed and also to ensure that 
it understood the legal advice that was given. 


NSLU chief Bowman told the OIG that it was unusual for a field office to 
be so adamant that there was sufficient information to support a FISA warrant 
and for the SSA to be so adamant that there was not. Moreover, the Moussaoui 
FISA request was unlike most other FISA requests. In most others, even if the 
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NSLU did not believe that there was sufficient information to support going 
forward on the FISA request, the field office could continue to investigate the 
subject for months, acquire additional information in support of the FISA 
request, and come back to the NSLU for another opinion. Because Moussaoui 
was going to be deported shortly, the opinion that there was insufficient 
evidence to seek a FISA warrant was, in effect, a denial of the FISA request. 
In light of the unusual circumstances of this case, it would have been a better 
practice for the NSLU attorneys to inquire about available documentation and 
review it before rendering an opinion. In this case, however, a comprehensive 
legal review of the documentation in the Moussaoui investigation did not take 
place. 


Part of the problem was that the FBI did not assign one NSLU attorney to 
be responsible for a case. Both Martin and Don told the OIG that they relied 
on the NSLU attorneys to help them apply the relevant legal standards to the 
facts collected from the field and elsewhere. Because they sought advice from 
several NSLU attorneys in the Moussaoui case, none who felt solely 
responsible for the case, no one from the NSLU considered all of the 
information available and no one from the NSLU was sufficiently informed to 
assess the totality of the facts and circumstances. 


It is impossible to determine for certain whether any of the NSLU 
attorneys would have provided a different recommendation concerning the 
Moussaoui FISA request if they had read all the documentation, including the 
6-page LHM or the 26-page EC. Moreover, we are not suggesting that SSAs 
should be required to provide, or that NSLU attorneys should be required to 
review, all of the documentation with respect to FISA requests in every case. 
But we believe that the circumstances of the Moussaoui FISA request 
warranted a full review of all available documentation and a more careful legal 
analysis of that information. 


We also found that the advice that was presented to the field was not 
complete or accurate. For example, in the meeting between the RFU and 
Bowman to assess whether there was sufficient evidence to seek a FISA, 
Bowman advised that even if the FBI could establish a foreign power for the 
Moussaoui FISA request, the request lacked sufficient evidence to show that 
Moussaoui was an agent of that foreign power. After the meeting Martin did 
not correctly report to the field what was required to establish such an agency 
relationship. While Martin accurately reported Bowman’s advice that there 
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was insufficient evidence to establish that Moussaoui was an agent of a foreign 
power, he wrote that the FBI needed evidence to show that Moussaoui was an 
“integral part” of a terrorist organization to establish agency. This was not 
correct. To show agency, the FBI needed to show that the agent of the terrorist 
organization demonstrated more than mere sympathy or vocal support for the 
goals of a terrorist organization. The agent must be shown to be working “for 
or on behalf of” the terrorist organization. Nothing in the legislative history of 
FISA, the Attorney General Guidelines, or the caselaw suggests that the 
purported agent would have to be an “integral part” of the terrorist organization 
to fulfill the FISA requirement of agency." 


The FBI also did not ensure adequate involvement by the CDCs in the 
field’s preparation of FISA requests. Field offices were not required to consult 
with CDCs about their FISA requests. The role of the CDC in providing 
advice on intelligence investigations and FISA applications varied by office, 
but we were told by many witnesses that the CDCs in smaller offices were not 
generally involved. NSLU attorneys we interviewed also told us that CDCs 
generally were not sufficiently knowledgeable about FISA to provide advice 
and that they generally deferred to the NSLU. We were also told that it was 
not uncommon for the CDCs in the field to avoid intelligence investigations. 


In this case, CDC Rowley acknowledged that she lacked extensive 
knowledge about FISA and that she was not in a position to advise the 
Minneapolis FBI on the issues surrounding the FISA request. We believe that 
the FBI should have ensured that CDCs, at a minimum, had sufficient training 
and visibility among agents to assist them in assessing the legal requirements in 
intelligence investigations.'°* Such expertise would be helpful to field offices, 
especially in cases like Moussaoui where there were problems connecting him 
to a foreign power and the field disagreed with the advice it was receiving from 
FBI Headquarters. 


151 Bowman told the OIG that he did not advise Martin that the FBI needed evidence 


showing that Moussaoui was an integral part of a terrorist organization and that Martin must 
have misunderstood their discussion. 


152 NSLU attorneys informed us that they had provided training to CDCs at various 


conferences and sessions. However, despite this training, CDCs were not as knowledgeable 
about FISA law and processes as they needed to be. 


206 


Finally, because of the strong disagreement between Minneapolis and 
FBI Headquarters on this case, we believe the matter should have been at least 
referred to OIPR for its evaluation. While the Minneapolis FBI did not push 
for an OIPR review, and FBI Headquarters did not seek it, such a review would 
have been an appropriate approach to resolving the dispute in this case. The 
role of the NSLU is to provide advice and guidance to the field, but we believe 
the NSLU should have consulted with OIPR in this case, particularly because 
the field office felt so strongly that Moussaoui posed a danger. As discussed 
above, while it is not clear whether OIPR would have, in fact, sought the FISA 
warrant given the prevailing standards at the time, OIPR should have at least 
been consulted on this matter. 


G. The Phoenix EC 


The FBI’s computer records show that RFU IOS Robin accessed and 
printed the Phoenix EC on August 22. She saw it when she searched in ACS 
for the term “Ibn Khattab.” Khattab is mentioned in a paragraph of the 
Phoenix EC that describes how the author of the EC interviewed the subject of 
an investigation who had a picture of Khattab and a picture of Bin Laden on 
the wall of his apartment. As described fully in Chapter Three, the EC also 
asserted there were “an inordinate number” of persons of interest to the FBI 
who were receiving training in aviation-related fields of study and that there 
was a possibility that Bin Laden was coordinating an effort to train people in 
the United States to conduct terrorist activity in the future. 


Robin told the OIG that she did not specifically recall reading the 
Phoenix EC, although she believed that she must have read it because her 
practice was to read documents that she printed. She did not bring the Phoenix 
EC to anyone else’s attention at FBI Headquarters, such as Martin or attorneys 
in the NSLU, or in any field office, including in Minneapolis.’ She said she 
did not know why she did not bring the EC to anyone’s attention. She added 
that after reading it some time after September 11, she concluded that she must 
have thought there was nothing in the EC that bolstered Moussaoui’s 


153 As discussed in Chapter Three, although Don and Martin’s names were on the 


“attention” line of the Phoenix EC, neither Don nor Martin accessed it in ACS or otherwise 
became aware of the Phoenix EC until after September 11. 
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connection to Khattab for the foreign power element of the FISA request. She 
also suggested that the reporting of information about individuals who were of 
interest to the FBI — that they were Middle Eastern and were in flight school — 
was not significant because there were thousands of Middle Eastern men in 
U.S. flight schools at the time. 


We discussed the Phoenix EC with the four NSLU attorneys who were 
consulted about the Moussaoui matter. All said they had not seen the Phoenix 
EC before September 11. All said that the Phoenix EC itself would not have 
conclusively led to a FISA warrant, but three of the attorneys said that if they 
had seen the Phoenix EC in connection with the Moussaoui case, they would 
have responded differently than they did when asked about the adequacy of the 
Moussaoui FISA request. When asked about the adequacy of the Moussaoui 
FISA request, Howard said that if he had seen the Phoenix EC at the time, it 
would have “made a difference in the pucker factor,” and he would have called 
CDC Rowley in Minneapolis and discussed the importance of tracking down 
the available leads to find out as much information about Moussaoui as 
possible. Susan and Tim said that if they had read the Phoenix EC at the time, 
they would have been concerned enough about Moussaoui to bring the matter 
to an OIPR attomey’s attention. According to Susan, she had even asked 
Robin whether the FBI had any information indicating anyone was sending 
people to the United States for flight training, but Robin did not mention the 
Phoenix EC.'* 


We believe that Robin should have recognized the potential relevance of 
the information in the Phoenix EC to the Moussaoui investigation and made 
others aware of it. Although the EC did not specifically mention Moussaoui or 
anyone else involved in the Moussaoui investigation, the EC discussed the 
possibility that persons under investigation by the FBI were terrorists working 
for Bin Laden and receiving training in aviation-related fields in the United 
States for the purpose of conducting terrorist activity in the future. The 


154 Contrary to the other three NSLU attorneys, Bowman told the OIG that while 


coincidences between Moussaoui and the information in the Phoenix EC were apparent after 
September 11, he did not believe that he would have made any such connections or taken 
different action if he had read the Phoenix EC at the time of the Moussaoui matter. 
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Minneapolis FBI also suspected Moussaoui of being a terrorist receiving flight 
training, and the Phoenix EC was relevant to that theory. 


Robin’s failure to bring the Phoenix EC to anyone’s attention is another 
example of how the FBI focused on establishing direct links between targets 
and foreign powers, but failed to appreciate how indirect evidence also could 
be useful in supporting FISA requests. 


H. Edits to Minneapolis FBI’s FISA request 


Rowley and some of the Minneapolis FBI agents believed that Martin 
edited the Minneapolis FISA request to ensure that it would fail. They were 
most concerned that Martin had removed the section describing Moussaoui’s 
connection to a foreign power. They asserted that Martin softened the 
language of the FISA request in other respects, and that FBI Headquarters 
should not have made substantive changes to the field’s FISA request because 
it altered the meaning and tended to make it less accurate. 


Our review found that Martin edited the request as he did other requests, 
and we do not believe he changed the document to intentionally undermine the 
Moussaoui FISA request. Moreover, Martin sent all of his proposed changes to 
Minneapolis for review. Martin deleted the three paragraphs of information 
about Moussaoui’s connections to Khattab and the statement that Khattab was 
a close associate of Bin Laden. When Gary raised concerns about this deletion, 
Martin responded with an e-mail stating that the foreign power information 
would be added back in once an NSLU attorney had approved the use of al 
Qaeda as the foreign power. 


Gary also questioned the accuracy of some of the other changes Martin 
had made. In some instances, Martin agreed to some of the wording Gary 
suggested but kept his own wording in other instances. 


Preparing the FISA request for approval within FBI Headquarters and the 
NSLU for eventual submission to OIPR was primarily the responsibility of the 
SSA assigned the FISA request. An SSA and an IOS at FBI Headquarters 
typically edited the LHM submitted by the field office requesting the FISA 
warrant. The extent of the editing depended on the quality of the field office’s 
LHM and the judgment of the SSA and IOS who were handling the FISA 
request. In some instances, the LHM was completely rewritten and a different 
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foreign power was used. In other cases, the IOS would check the accuracy of 
facts as reported by the field office, with no other editing. 


The foreign power section of the LHM was usually several pages long. 
The SSA or IOS normally would copy relevant language from other FISA 
requests in which the same foreign power had been used. They also would add 
information to the LHM when they had uncovered additional information in 
their research to support the foreign power element. 


Martin was the SSA responsible for the Moussaoui FISA request and the 
SSA who would have had to swear to the affidavit filed with the FISA Court. 
Most of the edits made by Martin were stylistic. Moreover, Martin did not hide 
any of his edits. He returned the revised draft of the LHM to Gary for his 
review and asked for comments. The evidence also showed that Martin was 
planning to prepare an entirely new foreign power section that would contain 
all of the necessary foreign power information. Martin also responded to 
Gary’s concerns about the removal of the foreign power information and the 
other edits. Martin made some changes based on Gary’s suggestions and gave 
explanations for the edits that he declined to change. We believe these actions 
suggest that Martin was not intentionally undermining Minneapolis’ attempts 
to obtain a FISA warrant. 


We also concluded that Martin’s edits did not significantly change the 
FISA request. For example, the Minneapolis FBI had written, “Moussaoui had 
no convincing explanation for the large sums of money known to have been in 
his possession,” which Martin changed to “Moussaoui would not explain the 
large sums... .” After Gary noted in his e-mail that the problem was that the 
Minneapolis FBI believed that Moussaoui could have explained that matter but 
chose not to, Martin changed the statement to “Moussaoui did not give a 
logical explanation for the large sums... .” 


However, a few of Martin’s changes were unnecessary and altered the 
meaning of the LHM to some extent. For example, Martin changed the 
statement that “Al-Attas admitted that Moussaoui . . . is preparing himself to 
fight” to “Al-Attas stated that he and Moussaoui [sic] own boxing gloves and 
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train together in defensive tactics.” Gary responded that neither Al-Attas nor 
Moussaoui used the term “defensive tactics,” and that the change “soften[ed] 
our argument” and misrepresented Al-Attas’ statements. In his response 
e-mail, Martin simply wrote that he believed that the way he had it written was 
“accurate.” 


Although Gary challenged some of the changes as “softening” the FISA 
request, Martin wrote that he believed that the way he had it written was 
“accurate.” 


We believe that some of Martin’s edits made Minneapolis’ request slightly less 
persuasive had it gone forward to OIPR. However, the edits did not make major 
changes and were not indicative of a deliberate attempt to sabotage the Minneapolis 
FBI request. 


I. Inadequate dissemination of threat information 


Although FBI Headquarters disseminated a teletype to the Intelligence 
Community about Moussaoui on September 4, the FBI did not include any of 
the threat assessment information about Moussaoui that was drafted by the 
Minneapolis FBI. We found that the FBI did not have clear guidelines for 
what threat information should be disseminated and where it should go. It was 
normally left to the discretion of an analyst or agent, without significant 
supervisory oversight. 


When the decision was made to deport Moussaoui and the FBI was 
considering using FAA sky marshals to accompany him to France, Don 
instructed the Minneapolis FBI to get the FAA “up to speed” on the case. 
Henry wrote a detailed memorandum providing the facts of the Moussaoui case 
and an assessment of the threat that Minneapolis believed he posed. Henry 
stated the belief that Moussaoui’s flight training was preparation for some 
future terrorist act and that his physical training and study of martial arts were 
“consistent with facilitating the violent takeover of a commercial aircraft.” 
Henry wrote: 


153 This was a reference to Al-Attas’ statement that he and Moussaoui were taking 


martial arts training. 
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Minneapolis believes that Moussaoui, Al-Attas, and others 
not yet known were engaged in preparing to seize a Boeing 
747-400 in commission of a terrorist act. As Moussaoui 
[redacted] was arrested before sufficient evidence of criminal 
activity was revealed, it is not known how far advanced were his 
plans to do so. As the details of this plan are not yet fully 
known, it cannot be determined if Moussaoui has sufficient 
knowledge of the 747-400 to attempt to execute the seizure of 
such an aircraft if he becomes free to do so in the future. 


One of the purposes of Henry’s assessment was to ensure that the FAA 
was made aware of Moussaoui. 


By contrast, the teletype prepared by the RFU and distributed outside the 
FBI did not have any threat assessment. According to Don, the purpose of the 
teletype was to provide information to and solicit input from the Intelligence 
Community, not to provide a threat assessment. He added that, prior to 
September 11, the FBI was a “case driven, fact specific” agency that did not 
ordinarily “speculate” or include “hypothetical information” in a teletype to the 
Intelligence Community. He stated that since September 11 the FBI has 
attempted to provide more analysis in disseminations of this type about 
potential threats from individuals or groups. Similarly, Martin told the OIG 
that he attempted to include the known facts about Moussaoui in the teletype. 


We concluded that the RFU’s teletype on Moussaoui omitted significant 
facts, such as the fact that Moussaoui knew how to operate the 747-400 Mode 
Control Panel, the aircraft’s automated feature that allows the aircraft to fly, 
navigate, and, in some cases, land in a fully automated manner. Nor did it 
contain any assessment of the facts — either Minneapolis’ or the RFU’s — 
despite Martin’s acknowledgement that he considered Moussaoui to be “a dirty 
bird,” even if he did not believe Moussaoui could be connected to a foreign 
power under FISA. The RFU’s teletype was not distributed to all FBI field 
offices, an action that may have generated helpful responses, especially in 
locations like Phoenix where similar issues had arisen. The teletype also was 
not distributed to all agencies in the Intelligence Community. 
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J. Inadequate training 


We found that the FBI did not provide adequate training to the SSAs and 
the IOSs in ITOS, on either analytical procedures or on building a FISA 
package. The IOS and the SSA in this case had not received any specific 
training on FISAs or on foreign intelligence generally. 


SSAs came to FBI Headquarters with different backgrounds, and the 
level of training given to the agents in intelligence matters varied. Moreover, 
the SSAs normally stayed approximately 18 months in ITOS and then moved 
back out to the field. While Martin had a background in terrorism 
investigations, he had handled FISA applications and renewals with respect to 
only two targets while working in the field. He told us that one of the two 
cases already had an active FISA order when he was assigned to the case, and 
he handled only the renewals. Thus, after initiating only one FISA application 
in the field, Martin assumed responsibility in FBI Headquarters for advising the 
field on FISA issues and creating FISA packages for OIPR on behalf of 
multiple field offices. He received little formal training in this area. In 
addition, although the FISAs he handled covered surveillance of different 
terrorist groups, he did not receive any additional formal substantive or 
process-oriented training prior to assuming his SSA position at FBI 
Headquarters. 


We were told that most of the SSAs’ training at FBI Headquarters was 
provided informally by the IOSs, who were permanent Headquarters 
employees and did not rotate through the units like SSAs. Several ITOS 
employees told us that the section could not have run without the IOSs. Prior 
to September 11, there were several paths to becoming an IOS. Some IOSs 
were promoted from within the FBI from other, sometimes clerical, positions. 
The FBI also hired some IOSs from outside the FBI, many of whom had 
graduate degrees. From our interviews of the IOSs, we found widely divergent 
skill and knowledge levels. 


The IOS in the Moussaoui case, Robin, had no formal analytical training. 
She began with the FBI as a clerk in the records branch after graduation from 
high school. Her formal training consisted of some courses at Quantico several 
years ago, and occasional briefings from NSLU attorneys regarding updates 
and changes in the law. This training was not sufficient for the many analytical 
challenges they faced. It also clearly was insufficient to have the IOSs do most 
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of the training of incoming SSAs, who are responsible for overseeing, 
coordinating, and contributing to all field intelligence investigations. 


IV. Individual performance 


As detailed above, numerous systemic problems affected how the FBI 
handled the Moussaoui case. We believe that these systemic problems caused 
the main deficiencies in the Moussaoui investigation. Placing blame on 
individuals alone for the problems in the Moussaoui case would unfairly single 
them out for actions that we believe were not inconsistent with the FBI’s 
prevailing practices at the time. 


However, some deficiencies by individuals in this case warrant criticism. 
Although we believe that no one committed intentional misconduct, 
deliberately undermined the case, or violated established FBI or Department 
policies or procedures, we believe that some individuals did not do all they 
could have, and should have, to help pursue the Minneapolis FBI’s strong 
concerns about Moussaoui. By contrast, the actions of some individuals 
warrant praise. In this section, we discuss the performance of individuals 
involved in the case. 


A. RFU 


1. Don 


As Chief of the RFU, Don was responsible for ensuring that the 
Minneapolis FBI’s requests to obtain a warrant to search Moussaoui’s 
possessions received adequate review. Don recognized that the Moussaoui 
case was unusual. He directed his staff several times to consult with NSLU 
attorneys on the FISA request. He also took the unusual step of seeking a 
review of the request from the chief of the NSLU, Bowman. 


Yet, we believe that Don too quickly concluded that there was 
insufficient probable cause for a criminal search warrant in the Moussaoui 
case, and he never carefully reconsidered that view, despite the additional 
evidence that was uncovered. He also never reviewed the entire file or ensured 
that the NSLU received all the documentation or the facts, despite the RFU’s 
pledge that the NSLU would give it a good faith review. He did not reconsider 
whether a criminal warrant could be obtained, even when the FISA request was 
no longer considered an option. 
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However, these shortcomings were not an intentional attempt to sabotage 
the case, as Rowley implied. We have no doubt that Don believed there was 
insufficient evidence for probable cause. It is also important to recognize that 
he had numerous other cases in the unit and responsibilities that demanded his 
attention. But the Moussaoui case was unusual, given the circumstances under 
which it was presented to FBI Headquarters and the vehemence of the field 
office’s concern that Moussaoui was preparing to commit a terrorist act. In 
light of that background, Don did not give the matter the careful evaluation this 
case deserved. Nor did he address the problem of a suspected terrorist like 
Moussaoui who could not be connected to a “recognized” foreign power under 
FISA. According to the Minneapolis agents, when they raised questions about 
this issue and asked about other options, Don said there were none and that 
they should not worry about it. He did not look for solutions in this case, 
which was the role of the RFU. 


He also too quickly discounted important facts, such as the statement by 
Al-Attas about going on “jihad.” OIPR Counsel Baker suggested that this 
comment was significant and he would “have tied bells and whistles” to the 
jihad comment in a FISA application. In sum, we believe Don too quickly 
discounted the facts and the assessment of the field office in assessing the 
possible threat that Moussaoui posed. 


2. Martin 


By many accounts, Martin was a responsible and conscientious agent. It 
is important to note that he assisted with the plans to deport Moussaoui to 
France. He consulted with the Legat Offices in both London and Paris to see 
which country would best be able to handle a search of Moussaoui’s 
belongings upon entry. Martin was informed that French authorities believed 
they would be able to search his belongings upon his arrival, and Martin was 
supportive of this plan and assisted in coordinating it. 


However, we concluded that Martin’s performance in this case was 
lacking in many respects. Although his personality was described as “easy 
going” by some, it is clear that he and the Minneapolis agents clashed. The 
Minneapolis agents distrusted his advice, and he believed that the Minneapolis 
Field Office became “spun up” too easily. 
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Like Don, Martin quickly viewed the Minneapolis agents as jumping to 
conclusions based only on gut feelings. We believe he hardened his position 
and did not evaluate the case fully. He was not open-minded or creative in his 
approach to obtaining a FISA warrant in this unusual case. Rather, he told the 
field what it could not do, but never fully considered solutions to the FISA 
problem or even explained the problems to them fully. Despite the fact that the 
Minneapolis FBI was extremely concerned that Moussaoui could be involved 
in a terrorist act and Martin’s own acknowledgment that he thought Moussaoui 
was “a dirty bird,” Martin did not aggressively seek to help Minneapolis 
understand the barriers or think creatively about how it could obtain what it 
believed it needed. 


It also appeared to us that he viewed the Minneapolis FBI as an 
adversary, rather than helping the agents understand the options and guiding 
them through the complicated issues of FISA. We also were troubled by 
Martin’s response when we asked whether he reconsidered seeking a criminal 
warrant after the FISA route was ruled out. He suggested it was Minneapolis’ 
responsibility alone to consider this option. In our view, this response 
demonstrates a lack of initiative and acceptance of some of the responsibility 
by Martin. 


We also believe Martin undersold the case when he presented it to the 
NSLU attorneys for review, and he did not ensure that the attorneys received 
all the facts. He started the briefings by stating his belief that there was not 
enough evidence to obtain a warrant, rather than by explaining the case fully 
and seeking NSLU guidance. He never gave the NSLU attorneys the 
documentation prepared by Minneapolis. He did not ask the field to participate 
in the briefing or suggest that the NSLU contact the field directly. Although it 
was not the standard practice to involve the field in that way, this was not a 
standard case, and we believe the field should have been involved in the 
discussions. 


Martin also did not provide complete or accurate legal advice to the field 
office. He used shorthand — such as Moussaoui must be tied to a “recognized” 
foreign power or Moussaoui must be an “integral” part of a terrorist 
organization. This was not correct. This shorthand also did not provide the 
field clear guidance on what it needed to obtain a FISA warrant. 
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Martin’s edits to the field’s FISA request exacerbated the problem. 
Although most of his changes were stylistic, other changes softened the 
language slightly and appeared to us as unnecessary. We recognize that it was 
his job to review and edit a FISA request, where appropriate. But his edits 
furthered Minneapolis’ concern that Headquarters was not doing what it could 
to obtain a warrant and was instead unnecessarily and unfairly impeding the 
field’s efforts. 


Martin also did not ensure that the information presented by the field 
about the potential threat from Moussaoui was disseminated. He did not 
believe that a threat assessment should be sent without input from the 
Intelligence Community, and he disseminated his own teletype rather than 
forward the document prepared by Minneapolis that contained a threat 
assessment. But his teletype omitted important facts, and he did not provide it 
to all agencies in the Intelligence Community. 


In our view, Martin did not adequately handle this unusual case. He did 
not work with the Minneapolis agents adequately, educate them on FISA, or 
guide them through the complicated FISA process to determine if the FBI 
could legitimately accomplish what the field wanted and needed in order to 
thoroughly investigate Moussaoui. He did not fully brief the NSLU. He did 
not adequately provide the information on the potential threat posed by 
Moussaoui within and outside the FBI. He did not adequately consider 
alternative options for a criminal warrant after he concluded that there was not 
enough evidence for a FISA warrant under the prevailing standards at the time. 
Although his conduct did not violate a clear FBI policy, we believe his 
performance in this case was significantly lacking. 


3. Robin 


Robin, the IOS who worked with Martin, is also considered a hard 
working and competent employee. The IOS’s role was to support the SSA, and 
Robin supported Martin’s requests. However, when she uncovered the 
Phoenix EC, she did nothing with it. We believe she should have at least 
recognized the relevance of the EC and the potential relationship of its theories 
to the Moussaoui case. Several NSLU attorneys told us that had they known 
about the Phoenix EC, it might have made a difference in how they addressed 
the Moussaoui matter. At the least, they said, it would have caused them to 
consult with OIPR about the possibility of obtaining a FISA warrant for 
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Moussaoui. We think Robin should have brought the Phoenix EC to 
someone’s attention. 


B. NSLU attorneys 


Several NSLU attorneys provided advice to the RFU on the Moussaoui 
case, based on what they were told about the case. None read the 
documentation in the case or learned all the facts. The advice that they gave, 
based on what they were told and the prevailing conservative interpretation of 
FISA, was not unfounded. We do not believe any of the individual attorneys, 
including Bowman, were wrong in their advice or that they violated any 
specific policies or practices in place at the time. Yet, we believe that given 
the unusual nature of this case — in particular the strong disagreement between 
the field and Headquarters about whether probable cause existed to obtain a 
FISA warrant — they should have considered alternative approaches, contacted 
the Minneapolis FBI for more information, or at least consulted with OIPR to 
determine if there were creative approaches to this case. 


Part of the problem was how the NSLU operated — no single attorney was 
assigned responsibility for a FISA request. Instead, several attorneys were 
consulted at various times, and no one was required to review or understand the 
facts and be responsible for providing comprehensive advice on a FISA 
request. As a result, the attorneys relied on brief explanations from the RFU 
and never reviewed all the documentation. Nor did any attorney consider all 
the potential approaches, including whether the field should approach the 
USAO after the possibility of a FISA warrant was exhausted. But given this 
system, and the facts available to the NSLU, we do not think any of the NSLU 
attorneys committed misconduct or provided clearly inappropriate legal advice. 


C. Minneapolis FBI employees 


The Minneapolis agents deserve praise for their relentless efforts and 
their accurate instincts in assessing Moussaoui’s actions. They believed that 
Moussaoui posed a threat, and they aggressively and tirelessly investigated this 
prospect. Their tenacity deserves praise and recognition. 


We also believe that Rowley deserves credit for bringing forward the 
important issues relating to how the Moussaoui case was handled. Her 
complaints resulted in an important reassessment of how the FBI handled this 
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matter, and some of them raised valid concerns about FBI employees and 
operations. However, as we discussed in this chapter, we did not find that all 
of her allegations about the FBI or FBI employees to be meritorious. 


Moreover, Rowley’s performance in the Moussaoui investigation itself 
was lacking in several regards. As the Minneapolis CDC, she was responsible 
for guiding the Minneapolis agents through the complicated interrelationship 
between a criminal and an intelligence investigation. At the outset, she 
assumed that the USAO would not support a criminal warrant. Contrary to the 
implication in her letter, which placed the blame for failing to seek a criminal 
warrant solely on FBI Headquarters, she advised the field agents not to seek a 
criminal warrant. She did so without fully understanding the requirements of 
FISA and the difficulty of connecting Moussaoui to a recognized foreign 
power. She never provided guidance or help to the field agents on this critical 
issue. She did not consult with the NSLU about what was required under FISA 
or whether attempting to seek a criminal warrant was a better avenue. Nor did 
she ever reconsider her initial advice that the USAO would not seek a criminal 
warrant, even after the FISA route was exhausted. Along with FBI 
Headquarters, she should share some of the criticism for the failure to carefully 
and creatively assess the options for obtaining a warrant. 


While the Minneapolis agents’ aggressiveness in pursuing the Moussaoui 
investigation was commendable, we also believe that the Minneapolis agents 
contributed to some of the problems in the handling of the Moussaoui 
investigation. Gary and Henry sought to open a criminal investigation after 
opening the intelligence investigation without fully considering the 
ramifications of doing so or evaluating the potential tools available before 
deciding which avenue presented the best option. In addition, they failed to 
reconsider pursuing a criminal warrant once the FISA route was exhausted. 
Even if they believed that FBI Headquarters would still be unsupportive of a 
criminal warrant, there would have been nothing to lose in raising the issue 
again, and they could have attempted to bolster their argument for seeking a 
criminal warrant with the additional information that had been uncovered in the 
case since the matter was initially discussed. 


We also concluded that the Minneapolis FBI management should have 
taken more aggressive action to support its field agents. Several FBI 
employees commented to us that if the Minneapolis FBI felt strongly about this 
case, it should have raised its concerns at a higher level in FBI Headquarters. 
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They said that field office SACs often called the ITOS Section Chief in 
Headquarters, or a higher official, when the field office disagreed with the 
advice of a unit chief or wanted a further review of the unit chief’s decision. 
Section Chief Rolince told the OIG that he routinely received telephone calls 
from field office managers about disputes between the field and Headquarters 
and that approximately once a week a field manager would come to his office 
at Headquarters to discuss a dispute or issue between the field office and 
Headquarters. 


Gary even advised the Acting SAC, Roy, to push the issue up the “chain 
of command” at Headquarters. Roy talked to Don, but Roy did not push the 
issue further. Roy stated to the OIG that he believed that the Minneapolis FBI 
was “working things out” and that the Minneapolis FBI had yet to receive 
information that caused him to believe it was necessary to push the issue 
further. We believe, however, that given the adamant views of the field agents, 
he should have raised this issue to a higher level at the FBI. While we are not 
certain it would have made a difference, we believe he should have expended 
the effort. 


V. Conclusion 


In sum, we did not find that any employees committed intentional 
misconduct, or violated established FBI policies or practices, or attempted to 
deliberately sabotage the Moussaoui case. But the performance of several 
individuals involved with the case was lacking. The Minneapolis agents, who 
deserve credit for their tenacity and accurate instincts, did not receive sufficient 
support, either from their field office management and legal counsel or from 
FBI Headquarters. 


We believe that singling out individuals for criticism alone would miss 
the main problems demonstrated by the Moussaoui case. Even if FBI 
employees pursued this case more aggressively, consulted with OIPR, or 
sought a criminal warrant, it is not clear that this approach would have 
succeeded in obtaining a search warrant for Moussaoui’s possessions before 
September 11. However, this case evidenced systemic problems in how the 
FBI handled intelligence cases and provided guidance to the field. The 
problems included a narrow and conservative interpretation of the FISA 
requirements, inadequate analysis of whether to proceed as a criminal or 
intelligence investigation, adversarial relations between FBI Headquarters and 
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the field, and inadequate and disjointed review of potential FISA requests by 
the NSLU. In our view, these systemic problems were a more important cause 
of the deficiencies we found in the Moussaoui case. In addition the systemic 
problems hindered the FBI’s ability to detect and deter terrorism. 
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CHAPTER FIVE 
TWO SEPTEMBER 11 HIJACKERS: KHALID 
AL-MIHDHAR AND NAWAF AL-HAZMI 


I. Introduction 


In this chapter, we examine the FBI’s handling of intelligence 
information concerning two of the September 11 hijackers, Khalid al-Mihdhar 
and Nawaf al-Hazmi. Mihdhar, Hazmi, and three other terrorists hijacked and 
crashed American Airlines Flight 77 into the Pentagon. 


The FBI has asserted that it learned in late August 2001 that Mihdhar and 
Hazmi were al Qaeda operatives and that they had traveled to the United States 
in January 2000. In August 2001, the FBI also discovered that Mihdhar had 
entered the United States on July 4, 2001, purportedly for a month-long stay. 
In late August, the FBI initiated an investigation to determine whether Mihdhar 
was still in the country and to find him. The FBI was still searching for him at 
the time of the September 11 attacks. 


We examined the information that the Intelligence Community and the 
FBI had about Mihdhar and Hazmi prior to September 11. We found no 
evidence indicating the FBI or any other member of the Intelligence 
Community had specific intelligence regarding the September 11 plot. 
However, beginning in late 1999 and continuing through September 11, 2001, 
we found five junctures at which the FBI either learned of intelligence 
information about Mihdhar and Hazmi, could have learned of additional 
intelligence information about them, or could have developed additional 
information about their location and terrorist connections. These five junctures 
were: 


e In early January 2000, Mihdhar traveled to Kuala Lumpur, 
Malaysia, where he met with other al Qaeda operatives. Intelligence 
information developed by the CIA in early 2000 revealed that 
Mihdhar was a suspected al Qaeda operative, he traveled to 
Malaysia to meet with other al Qaeda operatives, and he had a 
multiple-entry U.S. visa. The CIA also discovered in March 2000 
that Hazmi had traveled to Los Angeles in January 2000. 
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e In late January 2000, Mihdhar and Hazmi both traveled to Los 
Angeles and then moved to San Diego, where they associated with a 
former subject of an FBI investigation and also lived with a long- 
time FBI asset.’”° 


e In late December 2000 and early January 2001, a reliable joint 
FBI/CIA source provided information related to the FBI’s ongoing 
investigation of the attack on the U.S.S. Cole. '°’ The source’s 
information linked Hazmi and Mihdhar with the purported 
mastermind of the Cole attack. 


e Inthe summer of 2001, the CIA and the FBI had various 
interactions regarding the FBI’s investigation of the Cole attack. 
These interactions touched on the participants in the January 2000 
Malaysia meetings and information developed by the CIA about the 
Malaysia meetings. 


e In August 2001, the FBI learned that Mihdhar had entered the 
United States on July 4 and began searching for him in early 
September 2001. It also learned that the purported mastermind of 
the Cole attack had met with Mihdhar and Hazmi in the Malaysia 
meetings. The FBI did not locate him before the September 11 
attacks. 


Yet, despite these ongoing discussions and opportunities for the FBI to 
learn about and focus on Mihdhar and Hazmi, including their presence in the 
United States, the FBI was not made aware of and did not connect important 
details about them until late August 2001, a short time before they participated 
in the terrorist attacks. Even in August, the FBI’s search for Mihdhar and 
Hazmi was not given any urgency or priority, and was not close to locating 
them by the time of the attacks. 


156 Hazmi had also traveled to and attended the January 2000 meetings in Kuala 
Lumpur, Malaysia. 


157 As noted previously, on October 12, 2000, two terrorist operatives in an explosive- 


laden boat committed a suicide attack on the U.S.S. Cole naval destroyer during a brief 
refueling stop at the port in Aden, Yemen. Seventeen sailors were killed and 39 were 
wounded in the attack. 
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In this chapter, we describe each of these five opportunities in detail. We 
set forth the available intelligence information regarding Hazmi and Mihdhar 
that existed at the time, whether the information was made available to the FBI, 
and what additional information about Hazmi and Mihdhar the FBI could have 
developed. In the analysis section of this chapter, we evaluate the problems 
that impeded the FBI’s handling of the intelligence information about Hazmi 
and Mihdhar before September 11. 


II. Background 


A. OIG investigation 


To investigate the issues involving Hazmi and Mihdhar, the OIG asked 
for and reviewed all documents the FBI had regarding them before 
September 11. The FBI search for these documents included searches of its 
Automated Case Support system (ACS), Integrated Intelligence Information 
Application (IIIA) system,’ and CTLink.’”’ In addition, searches were 
conducted on archived FBI e-mail messages and the FBI Director’s briefing 
documents. These searches were initially conducted in response to a request 
by the Congressional Joint Intelligence Committee’s Inquiry Staff, which was 
conducting its own inquiry into this subject. The OIG also obtained direct 
access to ACS so that we could conduct our own searches for relevant 
documents. In addition, we reviewed hard copy case and informant files to 
search for documents relevant to Mihdhar and Hazmi. 


In addition to reviewing these documents, we conducted more than 70 
interviews related to the Mihdhar and Hazmi matter. These included 
interviews of FBI IOSs, special agents, attorneys, and supervisors who had 
access to some of the relevant information or participated in meetings or 


158 TITA is a database designed to capture comprehensive amounts of information from 


counterintelligence, international, and domestic terrorism investigations. The system 
includes information ranging from biographical data on persons to profiles of terrorist 
groups. The FBI describes the system as “conducive to putting together information 
regardless of office of origin or case.” 


159 CTLink is a shared database used for the dissemination of intelligence information 


among agencies within the Intelligence Community. 
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operations related to these hijackers. We also interviewed FBI employees 
detailed to the CIA and FBI agents who participated in debriefings of 
intelligence sources who had relevant information. 


Because much of the information discussed in this chapter of the report 
involves the FBI’s interactions with the CIA, we also obtained information 
directly from the CIA. The DOJ OIG does not have oversight authority over 
CIA operations or personnel, and we therefore did not make assessments of the 
performance of CIA personnel. That issue is the responsibility of the CIA 
OIG, which is conducting its own inquiry in response to the JICI report. We 
had to rely on the cooperation of the CIA in providing access to CIA witnesses 
and documents that were relevant to the OIG’s oversight of the FBI. 


We interviewed CIA staff operations officers, analysts, and supervisors, 
as well as CIA employees detailed to the FBI, including a CIA employee 
detailed to the FBI’s New York Field Office’s Joint Terrorism Task Force. (S) 


Initially, the CIA made available to the OIG for review various 
documents that the CIA’s “Director of Central Intelligence (DCI) Review 
Group”’” had identified as being related to our inquiry. The Review Group 
had gathered these and other documents during its review of the September 11 
attacks and during additional searches conducted at the request of the JICI 
staff. We did not have independent access to CIA databases, and therefore we 
could not independently verify that all relevant documents had been provided 
to us. However, we had several lengthy sessions with members of the Review 
Group at which they identified the documents they used to support their 
conclusions regarding Hazmi and Mihdhar. The CIA permitted us to review 
but not have a copy of these documents. 


In addition, a member of the CIA General Counsel’s staff conducted 
additional searches for documents relevant to particular disputed issues. Asa 
result of that review, copies of additional relevant documents were also made 
available for our review. 


160 The CIA formed the DCI Review Group in late 2001 to assist the CIA in 
determining why it had not detected the September 11 plot. The group included former CIA 
case officers and CIA OIG personnel. 
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In response to the JICI report issued in December 2002, the CIA OIG 
initiated a review in February 2003 of the CIA actions related to the 
September 11 attacks. In July 2003 the CIA OIG review team informed us it 
had several more documents that were relevant to our review. These 
documents were made available to us to review, and redacted copies of the 
documents were provided to us in November 2003. The CIA OIG review team 
also provided additional relevant documents and information to us that it found 
during the course of its review. 


In February 2004, however, while we were reviewing a list of CIA 
documents that had been accessed by FBI employees assigned to the CIA, we 
noticed the title of a document that appeared to be relevant to this review and 
had not been previously disclosed to us. The CIA OIG had not previously 
obtained this document in connection with its review. We obtained this 
document, known as a Central Intelligence Report (CIR). This CIR was a draft 
document addressed to the FBI containing information about Mihdhar’s travel 
and possession of a U.S. visa. As a result of the discovery of this new 
document, a critical document that we later determined had not been sent to the 
FBI before the September 11 attacks (see Section III, A, 4 below), we had to 
re-interview several FBI and CIA employees and obtain additional documents 
from the CIA. The belated discovery of this CIA document delayed the 
completion of our review. 


B. Background on the CIA 


In this section of the chapter, we describe background information 
relevant to the interactions between the CIA and the FBI and the ways in which 
they exchanged intelligence. We begin with a discussion of the CIA’s 
authority and mission, organization, forms of communications, and ways in 
which the CIA passed intelligence to the FBI. We also discuss the role of the 
FBI’s employees who were “detailed” to work at the CIA. 


1. CIA authority and mission 


As discussed in Chapter Two, the National Security Act of 1947 created 
the CIA and established it as the nation’s lead foreign intelligence agency of 
the United States. The CIA engages primarily in the clandestine collection of 
“foreign intelligence” information — information relating to the capabilities, 
intentions, and activities of foreign governments or organizations, including 
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information about their international terrorist activities. The CIA is charged 
with evaluating and disseminating the intelligence information it collects. 


The CIA reports directly to the President through the Director of Central 
Intelligence (DCI), who is the head of both the CIA and the Intelligence 
Community. The DCI is the primary advisor to the President and the National 
Security Council on national foreign intelligence matters. George Tenet was 
named to that position in 1997. 


2. Organization of the CIA 


The work of the CIA is conducted primarily through three “directorates”: 
the Directorate of Operations, the Directorate of Intelligence, and the 
Directorate of Science and Technology. Each is led by a Deputy Director. 
Below we briefly describe the relevant structure and positions within each 
directorate. 


a. Directorate of Operations 


The Directorate of Operations is responsible for the clandestine 
collection of foreign intelligence. This takes place in field offices known as 
“stations.” '®' Smaller cities may have “bases,” which are sub-offices of the 
stations. “Operations officers,” also known as “case officers,” are responsible 
for collecting intelligence through contacts with human sources and through 
the use of technology. Collection management officers, also known as “reports 
officers,” are responsible for taking raw intelligence reported by the operations 
officers and removing from it the information that reveals the source, method 
of collection, or other sensitive information. The reports officers publish 
intelligence information in a form that can be made available to the Intelligence 
Community. 


The head of a station or base is usually an operations officer and is 
known as a Chief of Station (COS) or Chief of Base (COB). Stations and bases 


161 The CIA also has field offices within the United States that are part of the National 


Resources Division within the Directorate of Operations. They are responsible for the overt 
collection of foreign intelligence volunteered by individuals and organizations in the 
country. 
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are usually grouped by geographic division and report to the chief of the 
geographic division at CIA Headquarters. Within the geographic division at 
CIA Headquarters are “staff operations officers,” or “desk officers,” who 
provide operational research, advice, and other forms of case management 
support to the officers in the field. 


The CIA’s Counterterrorist Center (CTC), which is based in the 
Directorate of Operations but which draws on all CIA resources, is charged 
with preempting and disrupting international terrorism. The CTC is staffed by 
managers, analysts, operations officers, desk officers, and reports officers. The 
CTC collects and analyzes strategic intelligence on terrorist groups and state 
sponsors of terrorism to ascertain the capabilities, sources of support, and 
likely targets of terrorist elements, and to furnish detailed information on 
terrorist-related intelligence to the Intelligence Community. 


At the time of the events relevant to our review, the CTC operated a unit 
— that we call the “Bin Laden Unit” — that dealt exclusively with issues related 
to al Qaeda and Usama Bin Laden. The Bin Laden Unit was later merged into 
a larger group in the CTC. Although staffing levels fluctuated, approximately 
40-50 people worked within the Bin Laden Unit before September 11, 2001. 
The Bin Laden Unit was known as a “virtual station” because it operated from 
within CIA Headquarters but collected and operated against a subject, much as 
Stations in the field focus on a country. 


b. Directorate of Intelligence 


The Directorate of Intelligence, the analytical branch of the CIA, is 
responsible for the production and dissemination of timely, accurate, and 
objective intelligence analysis on foreign policy issues. It focuses analysis on 
key foreign countries, regional conflicts, and issues such as terrorism and 
narcotics trafficking. 


The Directorate of Intelligence is primarily composed of analysts who 
concentrate on particular areas of expertise. For example, intelligence analysts 
are assigned a particular geographic region to monitor the leadership, 
motivations, plans, and intentions of foreign governments in relation to U.S. 
national security interests. Additionally, counterterrorism analysts stationed in 
the CTC produce a range of long-term intelligence products about terrorist 
organizations and provide tactical analytic support to intelligence operations. 
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c. Directorate of Science and Technology 


The Directorate of Science and Technology is responsible for creating 
and applying technology in support of the intelligence collection mission. It 
employs a broad range of professionals, including computer programmers, 
engineers, scientists, and linguists. 


3. The CIA’s collection and internal dissemination of 
information 


Official internal communications between entities within the CIA are 
normally conducted by an electronic communication known as a “cable.” 
Cables are addressed to the stations, offices, or units within an office from 
which some action is expected. Information acceptable for sharing with a 
foreign government service is put into a section of a cable called a “tear line.” 


4. Passing of intelligence information by the CIA to the FBI 


The CIA shares intelligence with the rest of the Intelligence Community 
through a communication known as a “TD” (“Telegraphic Dissemination”). 
TDs can be sent to other Intelligence Community agencies, including the FBI, 
and are available to the Intelligence Community through the Intelink system. 


Another type of intelligence report used by the CIA when conducting 
business with other agencies is a CIR, or “Central Intelligence Report.” CIRs 
are used for disseminating information to a specific agency or group of 
agencies. CIRs to the FBI normally concern something occurring in the United 
States, involving a U.S. person or an ongoing FBI investigation. 


In addition to formal methods of communicating by the CIA to the FBI, 
much information can be shared with the FBI informally. CIA and FBI 
employees who have similar positions and expertise develop relationships and 
communicate informally while working together on related matters, either by 
secure telephones or in person. In addition, meetings are sometimes held to 
discuss a matter or a piece of intelligence that is of value to both agencies. 
According to the CIA employees we interviewed, when the CIA passed 
intelligence information or other kinds of information verbally or by another 
informal mechanism to the FBI, the information exchange normally would be 
documented through a TD or a CIR. However, they said that not every 
telephone call or conversation was documented. 
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C. FBI detailees to the CIA Counterterrorist Center 


In 1996, the FBI began detailing employees to work in the CIA’s CTC. 
During the time period relevant to this chapter of the report, five FBI 
employees were detailed to the CTC’s Usama Bin Laden Unit in four separate 
positions. Two of the positions were filled by personnel from the FBI’s 
Washington Field Office, and one position each was filled from the FBI’s New 
York Field Office and FBI Headquarters. *® 


1. FBI Headquarters detailees 


One of the FBI detailees assigned to Bin Laden Unit, who we call “Eric,” 
held a supervisory position as a deputy chief of the Bin Laden Unit.’ Eric, an 
FBI Headquarters supervisor in the Radical Fundamentalist Unit, was detailed 
to the CTC as a branch chief for a particular terrorist group in September 1997. 
In March 1999, FBI Headquarters transferred him from that part of the CTC to 
the deputy chief position in the Bin Laden Unit. According to Eric, he was told 
by FBI Assistant Director Neil Gallagher that there were a lot of problems 
between the FBI’s New York Field Office and the Bin Laden Unit and that he 
needed to mend the relationship. Eric stated that although he acted as a 
liaison between the CIA and the FBI, his primary job was to perform 
substantive work related to the Bin Laden Unit’s mission. 


Eric left the Bin Laden Unit in January 2000 and was replaced in July 
2000 by an FBI employee who we call “Craig.” '® By this time, the Bin Laden 
Unit had been placed into a newly formed group, which was a much larger 


162 Other FBI employees were also detailed to the CIA during this time. However, the 


FBI detailees to the CTC’s Bin Laden Unit were the only ones relevant to the issues in this 
review. 


163 A CIA employee was the other deputy chief in the Bin Laden Unit. Both the FBI 


detailee and the CIA employee reported to the chief of the Bin Laden Unit, a CIA employee. 


164 Eric told the OIG that when he arrived at Bin Laden Unit, he “walked into a buzz 


saw” and there was a great deal of animus from CIA employees toward the FBI detailees. 
Eric said this experience was vastly different from his tenure in another CTC section, where 
he was readily accepted and integrated into the CIA’s operations. 


165 No one filled the deputy chief position between January 2000 and July 2000. 
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organization than the Bin Laden Unit. Craig was designated as a deputy chief 
in the new, larger group. He described his primary job as being a “referent” for 
law enforcement issues. He explained this role as involving coordination 
between the FBI and CIA when they wanted to conduct joint interviews or 
when the CIA requested assistance with a law enforcement matter. 


Eric and Craig had access via computers on their desks to the CIA’s 
internal cables. Eric said that while he was at the CIA, he attempted to read all 
incoming Bin Laden Unit cables. However, he said that the amount of cable 
traffic was overwhelming and was too much for one individual to read 
consistently. In contrast, Craig told the OIG that he did not believe his job was 
to read all the cable traffic and that he did not even attempt to do so. 


2. Washington Field Office detailees 


Another FBI employee detailed to the Bin Laden Unit, an Intelligence 
Operations Specialist (IOS) who we call “Mary,” was assigned to CIA 
Headquarters from the FBI’s Washington Field Office in April 1998. Although 
she was assigned to work on issues of mutual interest to the FBI and the CIA, 
such as the East African embassy bombings,'® she also was assigned to work 
on unilateral CTC matters. She said that as a desk officer, she read and 
responded to cable traffic that was pertinent to the matters she was assigned. 
She nominally reported to a supervisor in the FBI’s Washington Field Office, 
but her work was assigned by her CTC supervisors at the Bin Laden Unit.'® 


The Washington Field Office also detailed to the CTC a special agent, 
who we call “Dwight.” His performance evaluations were done by the 
Washington Field Office, but his assignments came from CTC managers. He 
focused on the financial aspects of terrorism and obtained information through 
the CTC to help identify and investigate persons who were responsible for 


166 On August 7, 1998, nearly simultaneous vehicle bombs were detonated at the U.S. 


embassies in Nairobi, Kenya, and Dar es Salaam, Tanzania, killing over 200 people and 
injuring over 4,000. 


167 Her position was later transferred from the Washington Field Office to FBI 


Headquarters’ Usama Bin Laden Unit. 
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funding terrorism. He had access to CIA cables and reviewed them for 
potential leads or other information related to terrorist financing. 


3. New York Field Office detailee 


An FBI New York Field Office agent from its Bin Laden squad, who we 
call “Malcolm,” was also detailed to the CIA’s Bin Laden Unit in early 1999 at 
the request of John O’ Neill, the New York Field Office Special Agent in 
Charge for Counterterrorism at the time. Malcolm replaced another New York 
Field Office Bin Laden squad agent who had left the CIA’s Bin Laden Unit in 
August 1998. Malcolm told the OIG that he was not given instructions as to 
his specific duties at the CIA. He said he understood his job there was to be 
the “eyes and ears” of the New York Field Office and “to monitor” New York 
Field Office cases. He said his role was to “facilitate inquiries of mutual 
interest” and to act as a liaison for FBI offices around the country by following 
up on tracing requests and reporting on their status. He stated that he also 
spent a significant amount of time coordinating with the CTC in preparation for 
and during the trials that arose out of the FBI’s investigations into the East 
African Embassy bombings. He told the OIG that he did not review all cables; 
he reviewed only the cables that he thought were interesting, generally based 
solely on his review of the cable subject line. He said he reported to an SSA in 
the New York Field Office, not to anyone at the CIA. 


HI. Factual chronology regarding Hazmi and Mihdhar 


In this section of the report, we discuss in detail the five junctures before 
September 11, 2001, during which the FBI had an opportunity to obtain or 
develop information about Mihdhar and Hazmi but did not. We describe in 
chronological order the sequence of events regarding these five opportunities, 
including the information that the FBI obtained or could have obtained about 
Hazmi and Mihdhar. 


Many of the witnesses told the OIG they did not have specific 
recollection of the events and conversations related to the Hazmi and Mihdhar 
matter. In addition, we found few notes and documents relating to these events 
and conversations. The following is our best reconstruction of the events based 
on the participants’ recollections and the existing documentary evidence. 
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We show a timeline of the Hazmi and Mihdhar events described in this 
chapter on the next two pages of the report. 


A. Identification in January 2000 of Hazmi and Mihdhar as al 
Qaeda operatives 


This section describes the initial development and dissemination of 
intelligence information concerning Hazmi and Mihdhar. This intelligence was 
obtained by the NSA in late 1999 and early 2000. The intelligence led to a 
surveillance operation in Malaysia in which it was discovered that Mihdhar had 
a valid multiple-entry U.S. visa and photographs of Mihdhar meeting with 
other al Qaeda operatives were taken. 


There were several ways the FBI could have acquired this information 
from the CIA — through a CIR from the CIA to the FBI, informally through 
conversations between a CIA employee and FBI Headquarters employees, and 
through the FBI employees detailed to the CIA reviewing the CIA cable traffic. 
We reviewed whether this information was in fact passed to the FBI by the 
CIA, and based on the evidence, concluded that while the CIA passed some of 
the information about Mihdhar to the FBI, it did not contemporaneously pass 
the information about Mihdhar’s U.S. visa to the FBI. We concluded it was 
not disclosed by the CIA until late August 2001, shortly before the September 
11 terrorist attacks. We also reviewed whether FBI detailees to the CIA 
contemporaneously acquired this information and what action, if any, they took 
with respect to this information. 
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In addition, the CIA learned in March 2000 that Hazmi had boarded a 
United Airlines flight in Bangkok, Thailand, bound for Los Angeles, 
California, on January 15, 2000."* We also reviewed whether the FBI was 
informed of this information, and concluded that it did not learn about this 
information until August 2001. 


1. Background 


In late 1999, the Intelligence Community developed significant 
intelligence information regarding Hazmi and Mihdhar. At this time, the 
Intelligence Community was on high alert because of concerns involving 
possible terrorist activity planned in conjunction with the coming of the new 
Millennium. In addition to concerns about attacks at New Year’s Eve 
celebrations, the Intelligence Community was concerned that a terrorist attack 
was planned for January 3, 2000, which in the Islamic calendar is considered a 
“night of destiny.”'® There were additional concerns about potential terrorist 
attacks coinciding with the end of Ramadan, around January 6, 2000.” 


Several of these planned attacks were uncovered in December 1999. For 
example, on December 1, 1999, in Jordan, a plot to disrupt New Year activities 
with explosives designed to kill thousands of revelers, including U.S. citizens, 
was uncovered and thwarted with the arrest of 16 people. On December 14, 
1999, Ahmad Ressam was stopped at the United States/Canadian border in 
Washington state as he attempted to enter the United States in a vehicle loaded 
with explosives. It was determined later that he had intended to detonate the 
explosives at the Los Angeles airport. 


To be prepared for possible terrorist activity at the end of 1999, the FBI 
activated its Strategic Information Operations Center (SIOC). The SIOC is 


168 Mihdhar was also on the same flight, but that fact apparently was not known within 


the Intelligence Community until much later, in August 2001. 


16 During the course of the Cole bombing investigation, it was learned that an attack 


also had been planned against the U.S.S. The Sullivans in Aden, Yemen, on the same date. 
That attack failed because the attack boat sank before reaching its target. 


17° Ramadan is the ninth month of the Islamic calendar. Ramadan begins when 


authorities in Saudi Arabia sight the new moon of the ninth month. 
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located in a secure area within FBI Headquarters and contains several meeting 
rooms, conferencing equipment, communications equipment, computers, and 
other operational equipment. It allows the FBI to manage major investigations 
or other significant operations 24 hours a day, 7 days a week. 


During the Millennium period, the FBI operated its International 
Terrorism Operations Section from within the SIOC. In addition, the FBI 
detailed field supervisors with counterterrorism experience and other 
counterterrorism personnel to the SIOC for around-the-clock monitoring and 
response to possible terrorist activities. 


At the CIA, additional personnel were called in to work at the CTC and 
planned leave was canceled. In addition, personnel from the CIA and other 
Intelligence Community agencies were detailed to work in the FBI’s SIOC. 


During this period, personnel in the FBI’s SIOC prepared two daily 
briefings for the FBI Director and his executive staff, one at 7:30 a.m. and the 
other at 4:30 p.m. The daily briefings contained summaries of significant 
terrorism investigations and the latest intelligence related to counterterrorism. 
Accompanying the briefings were daily threat updates prepared each afternoon 
for the Director and his executive staff. The briefings and the threat updates 
were prepared by various people throughout the course of the day and night in 
the SIOC. 


2. NSA provides intelligence regarding planned travel by al 
Qaeda operatives to Malaysia 


In the midst of the Millennium period concerns in late 1999, the NSA 
analyzed communications associated with a suspected terrorist facility in the 
Middle East linked to Al Qaeda activities directed against U.S. interests. The 
communications indicated that several members of an “operational cadre” were 
planning to travel to Kuala Lumpur, Malaysia, in early January 2000. Analysis 
of the communications revealed that persons named Nawaf, Khalid and Salem 
were involved. In early 2000, the NSA analyzed what appeared to be related 
communications concerning a “Khalid.” 1 


171 The NSA had additional information in its database further identifying “Nawaf” as 


Nawaf al-Hazmi, a friend of Khalid. However, the NSA informed the OIG that it was not 
(continued) 
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The NSA’s reporting about these communications was sent, among other 
places, to FBI Headquarters, the FBI’s Washington and New York Field 
Offices, and the CIA’s CTC. At the FBI, this information appeared in the daily 
threat update to the Director on January 4, 2000. 


3. Mihdhar’s travel and discovery of his U.S. visa 


A CIA desk officer working in the Bin Laden Unit who we call 
“Michelle” determined that there were links between these people and Al 
Qaeda as well as the 1998 East African embassy bombings. In addition, the 
CIA identified “Khalid” as Khalid al-Mihdhar. 


Mihdhar arrived in Kuala Lumpur, Malaysia, on January 5, 2000. 
Mihdhar was traveling on a Saudi passport. This passport contained a valid 
U.S. visa. Mihdhar’s passport was photocopied and sent to CIA Headquarters. 


Several CIA cables contemporaneously discussed Mihdhar’s travel and 
the discovery of his U.S. visa in his Saudi passport. CIA records show that a 
CIA employee, who we call “James”’” and who was detailed to FBI 
Headquarters during the Millennium period, accessed one of these cables 
approximately two hours after it was disseminated in the morning, and he 
accessed another of the cables about eight hours after it was disseminated on 
the next morning. James discussed some information about Mihdhar with two 
FBI Headquarters employees on the evening of January 5, which we detail in 
Section 7 below. 


4. CIR is drafted to pass Mihdhar’s visa information to the FBI 


Dwight, the special agent detailed to the CIA’s Bin Laden Unit from the 
FBI’s Washington Field Office, also read the cables discussing Mihdhar’s U.S. 
visa within hours of each cable being disseminated. CIA records also show 


(continued) 

asked to conduct research on these individuals at that time, and it did not uncover that 
information on Hazmi. It was thought at the time that Salem might be Hazmi’s younger 
brother, and this was later confirmed. 


172 The CIA has asked the OIG not to identify the true names of CIA employees for 


operational reasons. 
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that Dwight’s immediate supervisor in the Bin Laden Unit opened one of the 
cables soon after Dwight. 


Dwight opened one of the cables, which reported that Mihdhar’s visa 
application had been verified and that he had listed New York as his intended 
destination. 


Around 9:30 a.m. on the same morning, Dwight began drafting in the 
CIA’s computer system a CIR addressed to the UBL Unit Chief at FBI 
Headquarters and an SSA in the UBL Unit at FBI Headquarters who we call 
“Bob.” Dwight’s CIR also was addressed to the FBI’s New York Field Office. 
The CIR first described the NSA information that had been received about 
Mihdhar, including the planned travel to Kuala Lumpur, Malaysia in early 
January. The CIR also discussed the potential links between the suspected 
terrorist facility in the Middle East and the 1998 East Africa embassy 
bombings. The CIR stated that photographs of Mihdhar had been obtained and 
would be sent to the FBI under separate cover. The CIR detailed Mihdhar’s 
passport and visa information, including that Mihdhar had listed on his visa 
application his intended destination as New York and that he planned to stay 
three months. Dwight also wrote that the CTC was requesting “feedback” on 
“any intelligence uncovered in FBI’s investigation” resulting from the 
information in the CIR. 


Michelle, the Bin Laden Unit desk officer who originally had taken 
notice of the information about Mihdhar and his connections to Al Qaeda, 
accessed Dwight’s draft CIR less than an hour after Dwight drafted it at 
approximately 9:30 a.m. Around 4:00 p.m. on the same day, Michelle added a 
note to the CIR in the CIA’s computer system: “pls hold off on CIR for now 
per [the CIA Deputy Chief of Bin Laden Unit].” 


CIA records show that the same morning, the CIA Deputy Chief of Bin 
Laden Unit, who we will call “John,” also had read the cable indicating that 
Mihdhar’s visa was valid and that New York had been listed as his intended 
destination. Around 6:30 p.m. on the same day, John again accessed this cable 
and then another cable, the same two CIA cables about Hazmi and Mihdhar in 
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the CIA’s computer system that Dwight had used in drafting the CIR. CIA 
records do not indicate that John accessed Dwight’s draft CIR.’” 


CIA records show that the CIA employee detailed to FBI Headquarters 
who we call James and who discussed the Mihdhar information with two FBI 
Headquarters employees, also accessed the draft CIR on the day it was drafted. 
In addition, two other FBI detailees accessed the draft CIR: Eric, the other 
Deputy Chief of the Bin Laden Unit, accessed it two hours after Dwight began 
writing it, and Malcolm, the New York Field Office’s detailee to the Bin Laden 
Unit, accessed it two days later. 


CIA records show that as of eight days later the CIR had not been 
disseminated to the FBI. In an e-mail to John in mid-January, Dwight had 
attached the draft CIR and wrote, “Is this a no go or should I remake it in some 
way.” The CIA was unable to locate any response to this e-mail. 


By mid-February, the CIR had not been sent to the FBI and was still in 
draft form in the CIA’s computer system. CIA records show that Dwight e- 
mailed a CIA contractor who handled computer matters and asked him to 
delete several draft cables in the computer system unrelated to this matter, but 
to save the draft CIR concerning Mihdhar. The contractor accessed the draft 
cable in the system the next day. 


When we interviewed all of the individuals involved with the CIR, they 
asserted that they recalled nothing about it. Dwight told the OIG that he did 
not recall being aware of the information about Mihdhar, did not recall drafting 
the CIR, did not recall whether he drafted the CIR on his own initiative or at 
the direction of his supervisor, and did not recall any discussions about the 
reasons for delaying completion and dissemination of the CIR. Malcolm said 
he did not recall reviewing any of the cable traffic or any information regarding 
Hazmi and Mihdhar. Eric told the OIG that he did not recall the CIR. 


The CIA employees also stated that they did not recall the CIR. 
Although James, the CIA employee detailed to FBI Headquarters, declined to 


173 According to John, once CIRs were drafted the CIA’s standard operating procedure 


was for the drafter to “coordinate” the CIR in the computer system, which notified the 
persons designated by the drafter that there was a CIR that required their attention. He said 
that it was not standard operating procedure to access CIRs in draft form. 
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be interviewed by us, he told the CIA OIG that he did not recall the CIR. John 
(the Deputy Chief of the Bin Laden Unit) and Michelle, the desk officer who 
was following this issue, also stated that they did not recall the CIR, any 
discussions about putting it on hold, or why it was not sent. 


5. Mihdhar in Dubai 


On the same day that Dwight was drafting the CIR, the CIA reported in 
an internal cable additional information about Mihdhar. The cable stated that it 
appeared that, despite his multiple entry visa, Mihdhar had not yet traveled to 
the United States. The cable then stated that it was up to the CTC as to 
whether anyone should inquire with the INS to verify whether Mihdhar had 
traveled to the United States." 


The cable also reported additional information about Mihdhar while he 
was in Dubai. 


CIA records reveal that this cable also was read by FBI detailee Dwight. 
However, Dwight did not include in the draft CIR the additional information 
about the lack of any indication that Mihdhar had traveled to United States or 
the additional information about Mihdhar in Dubai.'” 


6. CIA cable stating that Mihdhar’s visa and passport 
information had been passed to FBI 


Also on the same day that Dwight was preparing the CIR, Michelle, the 
Bin Laden Unit desk officer who was following the issue of Mihdhar, prepared 
a lengthy cable to several stations summarizing the information that had been 
collected at that point on Mihdhar and three other individuals who also were 
possibly traveling to Malaysia. The cable began, “After following the various 
reports, some much more credible than others, regarding a possible [Bin 


174 We did not determine whether the CIA actually contacted the INS pursuant to this 


suggestion. As we discuss below, we did determine INS records reflect that Mihdhar first 
entered the United States on January 15, 2000, and only entered again on July 4, 2001. 


175 This cable also was read by James, the CIA employee detailed to the FBI’s SIOC. 


As detailed below, he later discussed some of its contents with an FBI Headquarters 
employee. 
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Laden]-associated threat against U.S. interests in East Asia, we wish to note 
that there indeed appears to be a disturbing trend of [Bin Laden] associates 
traveling to Malaysia, perhaps not for benign reasons.” 


This cable then summarized the CIA’s information that indicated several 
individuals were planning to travel to Malaysia. In the paragraph describing 
Mihdhar, Michelle stated that Mihdhar’s travel documents, including a 
multiple entry U.S. visa, had been copied and passed “to the FBI for further 
investigation.” 


This cable —the fifth CIA cable to discuss Mihdhar’s U.S. visa — did not 
state by whom or to whom Mihdhar’s travel documents were passed. It also 
did not indicate how they had been passed, or provide any other reference to 
the passage of the documents. Because this cable was an internal, operational 
cable, it was not forwarded to or copied to the FBI. 


This cable was disseminated to various CIA stations approximately three 
hours after Michelle had noted in the cable system that Dwight was directed to 
hold off on sending his draft CIR to the FBI “for now per [the CIA Deputy 
Chief of the Bin Laden Unit].” 


When we interviewed Michelle, she stated that she had no recollection of 
who told her that Mihdhar’s travel documents had been passed to the FBI or 
how they had been passed. She said she would not have been the person 
responsible for passing the documents. According to Michelle, the language in 
the cable stating “[the documents] had been passed” suggested to her that 
someone else told her that they had already been passed, but she did not know 
who it was. The CIA Deputy Chief of the Bin Laden Unit also said he had no 
recollection of this cable, and he did not know whether the information had 
been passed to the FBI. 


Neither we nor the CIA OIG was able to locate any other witness who 
said they remembered anything about Mihdhar’s travel documents being 
passed to the FBI, or any other documents that corroborated the statement that 
the documents were in fact passed to the FBI. 


7. The Malaysia meetings and surveillance of Mihdhar 


After he arrived in Malaysia, Mihdhar was followed and photographed in 
various locations meeting with several different people. These events are 
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referred to as “the Malaysia meetings.” CIA employees wrote several cables 
contemporaneously about the Malaysia meetings, which we discuss below. 


a. First cable regarding Mihdhar in Malaysia 


The CIA prepared an internal cable stating that Mihdhar had arrived in 
Kuala Lumpur on the evening of January 5. The cable also described his 
activities with other Arabs who were unidentified at the time. This cable, 
which we refer to as the “first Malaysia meetings cable,” did not contain any 
information regarding passports or visas. 


b. January 5 FBI threat update 


It appears that this first Malaysia meetings cable was provided to the FBI. 
Sometime before the daily FBI executive briefing that took place on January 6 
at 7:30 a.m., the January 5 threat update information concerning Mihdhar was 
edited in the FBI’s SIOC. 


This January 5 threat update reflected an almost verbatim recitation of 
portions of the CIA’s first Malaysia meetings cable, including the same 
spelling mistake in reference to a particular place in Malaysia, which indicates 
that the CIA provided a copy of the first Malaysia meetings cable to the FBI. 
However, we were not able to determine who in the FBI received this 
information from the CIA or who edited the January 5 threat update. No one 
we interviewed at the FBI said they recalled handling information related to 
Mihdhar or the January 5 threat update. The threat update contained no 
reference to Mihdhar’s passport information or his U.S. multiple-entry visitor’s 
visa. 


The January 5 threat update also was made part of the January 6 
7:30 a.m. executive briefing document. This briefing did not contain any 
additional information about Mihdhar. The January 5 threat update was the 
only official document from this period located by the FBI that referenced the 
Malaysia meetings that were discussed in the first CIA Malaysia meetings 
cable. 
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c. Discussion between CIA and FBI employees about 
Malaysia meetings 


As noted above, computer records show that James, the CTC employee 
detailed to the FBI’s SIOC, read the cables and the draft CIR indicating that 
Mihdhar had a U.S. visa. Contemporaneous e-mails show that James discussed 
the Malaysia meetings with two FBI Headquarters employees in the SIOC in 
the early morning hours of January 6. Below we detail the cables and the 
evidence about the discussions that took place between the CIA and FBI 
personnel in the SIOC about the Malaysia meetings. 


Contemporaneous e-mail messages among CIA employees show that 
during the night of January 5 James briefed the FBI SSA who we call Bob 
about Mihdhar’s travel. At the time, Bob was an SSA in the UBL Unit in FBI 
Headquarters, which was operating out of the SIOC during this period. 


James wrote an e-mail to several CIA employees in which he stated that 
he was detailing “exactly what [he] briefed [the FBI] on” in the event the FBI 
later complained that they were not provided with all of the information about 
Mihdhar.'”® This e-mail did not discuss Mihdhar’s passport or U.S. visa. 


As previously mentioned, James told the CIA OIG that he had no 
recollection of these events. He declined to be interviewed by us. 


Bob told the OIG that he had no independent recollection of any briefing 
from a CIA employee regarding the Malaysia meetings. However, he was able 
to locate a scant contemporaneous note that confirmed he had been briefed 
regarding Mihdhar and his trip to Malaysia. This note contained no details as 
to the content of the briefing and no reference to Mihdhar’s U.S. visa. 


Bob told the OIG that he does not believe that he had been told in this 
conversation about Mihdhar’s U.S. visa. Bob stated to us that the presence of a 


176 James wrote these e-mails in response to an e-mail from another CIA employee who 


was detailed to the FBI SIOC. That employee reported on the morning of January 6 that he 
had been asked by an FBI employee for the latest on Mihdhar. James responded in a series 
of e-mails that he had already briefed the FBI. The final e-mail by James sets forth the 
details of his briefings. 
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U.S. visa in Mihdhar’s passport would have been extremely important and 
would have triggered a more significant response than his minimal notes. 


Bob also told the OIG that he did not know why James chose to brief him 
about Mihdhar. Bob said that he was not a designated point of contact for the 
CIA while the SIOC was activated, although he also said that he did not know 
whether there was a designated point of contact in the SIOC. Bob said that he 
knew James because James had previously been detailed from the CTC to FBI 
Headquarters and had worked in ITOS with Bob. 


d. Second cable regarding Mihdhar and the Malaysia 
meetings 


The day after the CIA employee discussed the Malaysia meetings with 
the two FBI SIOC employees, the CIA sent another internal cable providing 
new information about the activities of Mihdhar. This cable, “the second 
Malaysia meetings cable,” provided information about Mihdhar’s activities 
once he left the Kuala Lumpur airport and his meetings with various 
individuals. 


e. Discussion between CTC officer and FBI employee 
about Malaysia meetings 


Shortly after 7:30 a.m. on January 6, James briefed another FBI SSA — 
who we call “Ted” — who was detailed to the SIOC from an FBI field office, 
about information contained in the second Malaysia meetings cable. Ted told 
the OIG he was working in the SIOC as an “assistant” to the day shift 
commander and the UBL Unit Chief, but that he had no specific duties. 
Because Bob had left FBI Headquarters on a trip to New York by this time, 
James briefed Ted to ensure that someone at FBI Headquarters had the latest 
information on Mihdhar. 


In the same e-mail in which he had detailed what he told Bob, James 
provided specifics of what he told Ted. The e-mail also stated that the CIA 
would “continue to run this down and keep the FBI in the loop.” The e-mail 
did not contain any reference to Mihdhar’s passport or U.S. visa. 


Based on this briefing by James, Ted prepared an update for the January 
6 afternoon FBI executive briefing. Ted e-mailed the update to the ITOS 
Assistant Section Chief at 8:40 a.m. This update reflected the details of the 
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information Ted had received from James. It did not contain any reference to 
Mihdhar’s passport or U.S. visa. 


Like Bob, Ted told the OIG that he had no recollection of being briefed 
regarding the Malaysia meetings. Although he said he did not recall these 
events, Ted asserted he did not believe that he had received Mihdhar’s passport 
or U.S. visa information because if he had he would have unquestionably 
recognized their significance and documented such information in the update 
for the executive briefing. 


Ted told the OIG that he did not know why James briefed him about the 
Mihdhar information. Like Bob, Ted stated he was not a designated point of 
contact for the CIA while the SIOC was activated. Ted also knew James 
because of James’ previous detail to ITOS in FBI Headquarters when Ted 
served as an SSA in the RFU. 


f. Cables updating the Malaysia meetings information, 
including Mihdhar’s travel to Bangkok 


On January 8, the CIA reported in another internal cable that a new 
individual had joined Mihdhar and the others, and that additional surveillance 
photographs were taken. The cable did not state how many photographs were 
taken or what would be done with the photos. 


In another cable sent five hours later, the CIA reported in an internal 
cable that Mihdhar and two of the unidentified men — one of whom turned out 
to be Hazmi — departed Malaysia from Kuala Lumpur airport en route to 
Bangkok, Thailand. 


g. Cables regarding Hazmi’s travel to the United States 


On January 9, the CIA’s Bin Laden Unit prepared a cable asking that 
Mihdhar and his associates be identified while in Thailand. CIA records show 
that on January 13, the CIA was attempting to locate Mihdhar and his traveling 
companions. In addition, Mihdhar had been watchlisted at the airport in the 
event that he attempted to leave Thailand. 


Several weeks later, CIA officers in Kuala Lumpur followed up with 
their Bangkok counterparts for additional information about Mihdhar and his 
traveling companions. Approximately two weeks later, Bangkok reported that 
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there was a delay in responding due to difficulties in obtaining the requested 
information. 


In early March 2000, officials in Bangkok reported internally that it had 
identified one of Mihdhar’s traveling companions as Nawaf al-Hazmi. The 
cable reported that Hazmi had traveled to Bangkok on January 8 and had 
subsequently traveled on a United Airlines flight to Los Angeles, California on 
January 15. The cable also stated that Mihdhar had arrived in Bangkok on 
January 8 but that it was unknown if and when he had departed.'”” In addition, 
the cable identified the third traveler as Salah Saeed Mohammed Bin Yousaf.'” 


CIA records show that none of the FBI detailees accessed this early 
March cable. The OIG found no documents or witnesses indicating that the 
information that Hazmi had traveled to Los Angeles on January 15, 2000, was 
shared with the FBI at this time. Rather, as we discuss below, this fact was not 
shared with the FBI until August 2001. 


We found no indication that CTC personnel took any action with regard 
to the important information that Hazmi had traveled to the United States. For 
example, he was not placed on any U.S. watchlists. The day after Bangkok 
Station reported about Hazmi’s travel to Los Angeles, one office that received 
the Bangkok cable sent a cable to the CTC stating the Bangkok cable regarding 
Hazmi’s travel had been read “with interest.” Yet, despite this effort to flag the 
significance of this information, the cable was not shared with the FBI and did 
not result in any specific action by the CIA. 


As we discuss below, it was not until August 2001 that FBI Headquarters 
personnel learned that on January 15, 2000, both Mihdhar and Hazmi had left 
Thailand and traveled to Los Angeles, California, where they were both 


177 Tn fact, Mihdhar had traveled to the U.S. with Hazmi on January 15, 2000. This fact 
was not discovered by anyone in the Intelligence Community until August 2001. 


178 Yousaf left Bangkok on January 20 for Karachi, Pakistan. Some time after 


September 11, Yousaf was determined to be Tawfiq Muhammad Salih Bin Rashid al Atash, 
a/k/a Khallad, the purported mastermind of the Cole attack. We discuss the FBI’s discovery 
of information about Khallad and the Cole attack, and the FBI’s opportunities to connect 
Khallad to the Malaysia meetings, in Section III, C below. 
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admitted into the United States on non-immigrant visas and authorized to 
remain until July 14, 2000. 


8. OIG findings regarding FBI’s knowledge about Mihdhar 
and the Malaysia meetings 


We discuss here our findings regarding the FBI’s knowledge of 
information about Mihdhar and the January 2000 Malaysia meetings, including 
whether the intelligence information concerning Mihdhar’s valid multiple entry 
U.S. visa and Hazmi’s travel to the United States in January 2000 was passed 
to the FBI. Several witnesses told the OIG that Mihdhar’s possession of a U.S. 
visa provided a clear domestic nexus that should have triggered the passing of 
this information from the CIA to the FBI. 


At the outset, we note that the CIA has acknowledged that it obtained 
information that Mihdhar had a U.S. visa and that Hazmi had traveled to the 
United States, and that the CIA should have placed their names on U.S. 
watchlists, but that this did not occur.” The CIA OIG is reviewing this matter 
to determine why this failure occurred and who is responsible for it. 


a. Formal passage of information from the CIA to the FBI 


As noted above, the formal method of communicating intelligence 
information between the CIA and the FBI was an intelligence report called a 
CIR. CIA records show that between July 1999 and September 10, 2001, the 
Bin Laden Unit disseminated over 1,000 CIRs, most of which were sent to the 
FBI. CTC employees as well as FBI detailees to Bin Laden Unit had authority 
to draft CIRs, and the detailees collectively drafted over 150 CIRs to the FBI 
during this period. However, CIRs could only be disseminated by persons with 
authority to “release” the CIRs.*® In the Bin Laden Unit, only supervisors, 


179 Mihdhar and Hazmi were placed on watchlists by other countries, including 


Thailand. 


180 Once a supervisor approved a CIR for release, it was electronically disseminated by 


a unit in the CIA known as the Policy Community Action Staff. 
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including John and Eric as the deputy chiefs of the station, had authority to 
release CIRs.*®* 


Dwight drafted a CIR in which he summarized the information that had 
been disseminated by the NSA about Mihdhar. He also provided detailed 
information about Mihdhar’s passport, visa, and visa application indicating that 
New York had been his intended destination. According to CIA records, this 
CIR never was disseminated to the FBI. A desk officer’s note on the draft CIR 
indicated that the Deputy Chief of the Bin Laden Unit, John, had instructed the 
draft CIR be put on hold, and Dwight contacted him through an e-mail about 
the disposition of the CIR a week later. Despite this e-mail, the evidence 
clearly shows that the CIR never was disseminated to the FBI. 


The evidence shows, however, that Dwight acted in accordance with the 
system that was in place at the time by drafting the CIR to formally pass the 
visa information to the FBI. In accordance with Bin Laden Unit policy, 
Dwight was not permitted to pass the CIR to the FBI without permission. 


All of the witnesses stated, however, that they did not recall the CIR or 
any communications about it. Other than the note written by the desk officer, 
we found no documentary evidence about why the CIR was not disseminated. 
Thus, we were unable to determine why it was not sent. 


The information in the CIR, which was documented in the appropriate 
format for passage to the FBI, was potentially significant to the FBI and should 
have been passed to the FBI. We believe it was a significant failure for the 
CIR not to be sent to the FBI. 


b. Informal passage of information from CIA to FBI 


We also considered what information that James, a CIA detailee to the 
FBI, informally passed to FBI Headquarters and whether he informed anyone 
of the visa information about Mihdhar. Based on the contemporaneous e-mails 
in which James documented in detail what he told FBI SSAs Bob and Ted, we 
concluded that he reported to the FBI the information regarding Mihdhar’s 


181 CIA records show that Eric released five CIRs during his tenure at the Bin Laden 


Unit. 
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transit through Dubai, his arrival in Kuala Lumpur, his activities after his 
arrival, and his meeting with other suspected al Qaeda operatives. It is far less 
clear, however, whether he provided Mihdhar’s passport and U.S. visa 
information to the FBI. 


We do not believe that James briefed either Bob or Ted on Mihdhar’s 
passport or U.S. visa information. First, nothing in Bob’s contemporaneous 
notes or Ted’s e-mail or briefing update referred to Mihdhar’s passport or visa 
information. Bob and Ted also stated forcefully and credibly to us that they 
would have recognized the significance of a U.S. visa in the hands of a 
suspected al Qaeda operative and at a minimum would have included such 
information in their notes or reports. 


Moreover, James wrote a detailed e-mail to document the contents of his 
conversations with Bob and Ted. Since the stated purpose of James’ e-mail 
was to prevent the FBI from later claiming he had failed to brief them on some 
important details, he had every incentive to include all relevant details in that e- 
mail. At the time he wrote this e-mail, he had read three of the CIA cables 
indicating that Mihdhar had a U.S. visa, as well as the draft CIR. Yet, James’ 
e-mail contained no mention of Mihdhar’s passport or visa. 


We found only one piece of evidence suggesting that the FBI was made 
aware in January 2000 of Mihdhar’s U.S. visa — the early January cable by the 
desk officer who we call Michelle which stated that Mihdhar’s travel 
documents, including a multiple entry U.S. visa, had been copied and passed 
“to the FBI for further investigation.” We could not, however, find any 
evidence to corroborate that this information actually had been passed to the 
FBI. 


This cable did not state by whom or to whom the documents were passed 
or make any other reference to the passage of the documents. The cable was an 
internal cable, which means it would not have been forwarded to or accessible 
to the FBI. In addition, Michelle, the CIA desk officer who wrote the cable, 
had no recollection of who told her that the documents had been passed or how 
they had been passed. She said that she would not have been responsible for 
passing the information but instead would have been told by someone else that 
the documents had been passed. 


We were unable to locate any witness who said they remembered 
anything about the documents being passed to the FBI, as Michelle’s cable 
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asserted. Even if her cable was accurate, and she had been told by someone 
that the documents had been passed to the FBI, there is no evidence that such 
information was correct. The CIA and FBI witnesses we interviewed described 
this period as very hectic and said they were flooded with information. Several 
witnesses suggested that these hectic circumstances could have created an 
environment where unintentional misunderstandings might have occurred 
about whether information was actually passed to other Intelligence 
Community agencies. 


We also searched ACS for any FBI record of the travel documents having 
been provided to the FBI, since this cable indicated that a physical copy of the 
documents, not merely information about the documents, was passed. We 
found no reference to the documents. 


Aside from this cable, we found no other evidence that the information or 
documents about Mihdhar’s passport or visa information was in fact provided 
to the FBI during this time period. 


c. FBI detailees’ handling of information on Mihdhar 


As discussed above, five FBI employees were detailed to the CTC to 
work on Bin Laden matters during 2000 and 2001, and all had access at their 
desks to CIA internal cable traffic. Four of those employees — the supervisor 
who we call Eric, the IOS who we call Mary, and the agents who we call 
Dwight and Malcolm — were at the Bin Laden Unit in January 2000 when the 
Malaysia meetings occurred.'** We considered how each handled the 
intelligence information concerning Mihdhar during this period. 


After reading two of the cables indicating that Mihdhar had a U.S. visa, 
Dwight prepared a draft CIR to officially notify the FBI about that information, 
since the U.S. visa presented a nexus between Mihdhar and the United States. 
But the CIR was not provided to the FBI. However, we also examined whether 
any of the detailees took any other action to notify FBI Headquarters or, in 
Malcolm’s case, the New York Field Office, about the information concerning 
Mihdchar. 


182 The fifth detailee — the manager who we call Craig — did not arrive at the CTC until 


July 2000. 
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The evidence shows that each FBI detailee reviewed some of the cables 
about Mihdhar’s U.S. visa. Dwight accessed several of the cables that 
indicated Mihdhar had a U.S. visa, such as the cables stating that Mihdhar had 
transited through Dubai and had a U.S. visa, the cable stating that Mihdhar’s 
visa application listed New York as his intended destination in May 1999, and 
the cable stating that based on a review of Mihdhar’s visa, it did not appear that 
he had actually traveled to the United States. 


Malcolm also accessed the cable stating that Mihdhar’s visa application 
listed New York as his intended destination in May 1999, and the cable stating 
that it did not appear that Mihdhar had actually traveled to the United States. 
Malcolm also accessed the two cables stating that Mihdhar had arrived in 
Kuala Lumpur and that surveillance photos showed him meeting with others in 
Malaysia. Malcolm also accessed Dwight’s draft CIR indicating passage of the 
visa information to the FBI, including the New York Field Office. 


Mary accessed the January cable stating that Mihdhar’s travel documents, 
including a multiple-entry U.S. visa, had been passed to the FBI, but she did 
not access the previous cables reflecting the visa information or Dwight’s CIR. 
She also accessed the two cables stating that Mihdhar had arrived in Kuala 
Lumpur and that surveillance photos showed him meeting with others in 
Malaysia. 


Eric did not access these cables, but he accessed Dwight’s draft CIR 
which detailed Mihdhar’s visa information and which summarized the NSA 
information. 


However, Dwight, Malcolm, Mary, and Eric all told the OIG that they 
did not recall anyone from the CIA bringing to their attention the fact that 
Mihdhar had a U.S. visa. In addition, despite the records of their access to the 
cable traffic or the CIR, they all told the OIG that they did not recall 
discovering at the time — such as by reading a cable — that Mihdhar had a U.S. 
visa.’ As discussed above, Dwight told the OIG that he did not even recall 


183 The detailees also told the OIG that they did not necessarily read all of the cables 


they accessed. They explained that they often skimmed cables to determine if any action 
was required on their part or to find specific information in connection with a particular 
assignment or issue. 
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writing the CIR or even being aware of the Malaysia meetings or of the fact 
that Mihdhar had a U.S. visa. Eric told the OIG that his CIA counterpart — 
John, the CIA Bin Laden Unit Deputy Chief — mentioned the Malaysia 
meetings and that surveillance photos had been taken, but Eric did not recall 
ever hearing anything about Mihdhar having a U.S. visa. Mary told the OIG 
that she did not recall even being contemporaneously aware of the Malaysia 
meetings.'** Mary explained that she did not have reason to be made aware of 
the Malaysia meetings at the time because the matter had been assigned to 
another CIA desk officer — Michelle (the one who wrote the cable indicating 
that Mihdhar’s travel documents had been passed to the FBI). 


Malcolm said he was not aware of the fact that Mihdhar had a U.S. visa 
until after September 11. He stated that he recalled being shown the Kuala 
Lumpur photos, but he could not remember whether that was before or after 
September 11. He said that it was not until he was shown the Kuala Lumpur 
photos that he became aware of the Malaysia meetings. 


Yet, the evidence shows that all had accessed contemporaneously cables 
indicating that Mihdhar had a U.S. visa, which was important intelligence 
information that was never provided to FBI Headquarters. They did not violate 
any specific policy or procedure in their handling of the information, and they 
did not have the authority to unilaterally pass CTC information to the FBI 
without permission. This restriction included any informal passage of the 
information, such as by telephone call or in-person discussions. However, 
none of them, particularly Dwight, ensured that the information was provided 
to the FBI. Dwight drafted a CIR that would have provided the FBI with the 
important information about Mihdhar, but the CIR was not released by the 
CIA. Although Dwight followed up a few days later to ask whether the cable 
was going to be sent or whether he should remake it in some other way, there is 
no record of a response to his request, and no one could explain why the cable 
was not sent. We believe it was critical that the information be sent. We found 
no indication that this ever happened. 


184 When we showed Mary copies of an e-mail written by the CTC officer who had 


briefed SSA Bob and Ted, which indicated that she was copied on the e-mail, she said that 
she did not recall having read the e-mail. 
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This failure to send the information to the FBI, in our view, was also 
attributable to problems in how the detailees were instructed and supervised, 
and that these problems significantly impeded the flow of information between 
the CIA and the FBI. We discuss these systemic problems in detail in our 
analysis section later in this chapter. 


d. OIG conclusion 


In sum, the evidence shows that in January and March 2000, the CIA 
uncovered important intelligence information about Mihdhar and Hazmi: 


e They were al Qaeda operatives who had traveled to Malaysia, where 
they were photographed meeting with other suspected al Qaeda 
operatives; 


e They traveled to Bangkok with a third person; 
e Mihdhar had a valid, multiple-entry U.S. visa; and 
e Hazmi had traveled to Los Angeles in January 2000. 


Yet, we found that the CIA did not share significant pieces of this 
information with the FBI — that Mihdhar had a U.S. visa and that Hazmi had 
traveled to Los Angeles. An FBI detailee at the CIA drafted a CIR to share this 
information with the FBI, but that information was not released by the CIA to 
the FBI. We were unable to determine why this did not occur. No one we 
interviewed said they remembered the CIR or why it was not sent to the FBI. 
We consider it a significant failure for this CIR not to be sent to the FBI. 


In addition, the evidence shows that the limited information that was 
provided to FBI Headquarters — that Mihdhar traveled to Malaysia and met 
with other suspected al Qaeda operatives — was never documented by the FBI 
in any system that was retrievable or searchable, thus limiting the usefulness of 
the information that was shared. The FBI’s only official record of having 
received this information was in the hard copies of the January 5 threat update, 
which was attached to the January 6 executive briefing, and Ted’s e-mail 
summarizing information from his discussion with the CIA employee. We 
discuss this and other systemic problems in our analysis section below. 
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B. Hazmi and Mihdhar in San Diego 


1. Introduction 


The second set of events that may have led the FBI to discover Mihdhar 
and Hazmi’s presence in the United States related to their stay in San Diego. 
As noted above, on January 15, 2000, Mihdhar and Hazmi boarded a flight in 
Bangkok, Thailand, for Los Angeles. They were admitted to the United States 
on non-immigrant visitor visas and authorized to remain in the U.S. until 
July 14, 2000. Shortly after arriving in Los Angeles, they traveled to San 
Diego, California, where they were aided in finding a place to stay by Omar 
al-Bayoumi. Bayoumi had been the subject of an FBI preliminary intelligence 
investigation that had been closed. 


In late May 2000, Hazmi and Mihdhar rented a room in the residence of 
an FBI asset.’® Mihdhar remained in San Diego until June 10, 2000, when he 
left the United States." Hazmi remained in the San Diego area until 
approximately December 2000, when he moved to the Phoenix, Arizona area. 
In Phoenix, Hazmi lived for approximately three months with another 
September 11 hijacker, Hani Hanjour. In April 2001, Hazmi and Hanjour 
moved to New Jersey and remained on the East Coast until September 11. 


While residing in San Diego in 2000, Mihdhar and Hazmi did not act in 
an unusual manner that would draw attention, but they did not attempt to hide 
their identities. Using the same names contained in their travel documents and 
known to at least some in the Intelligence Community, they rented an 
apartment, obtained driver’s licenses from the state of California Department 
of Motor Vehicles, opened bank accounts and received bank credit cards, 
purchased a used vehicle and automotive insurance, took flying lessons at a 
local flying school, and obtained local phone service that included Hazmi’s 
listing in the local telephone directory. 


185 This kind of individual is often referred to as an “informant” - the common 


vernacular for an individual providing information to an investigative agency. Within the 
FBI’s foreign intelligence program, they are known as assets. 


186 Mihdhar departed from Los Angeles on Lufthansa Airlines. 
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Although Hazmi and Mihdhar were in San Diego for a significant period 
of time, the FBI did not learn of their presence there until after September 11, 
2001. After September 11, much would be learned about Hazmi and 
Mihdhar’s time in San Diego and the Intelligence Community’s missed 
opportunities to find and investigate them before the terrorist attacks in which 
they participated. In this section, we describe the facts surrounding Hazmi and 
Mihdhar’s residence in San Diego, including their associations with two 
persons known to the FBI. 


2. Hazmi and Mihdhar’s association with Bayoumi 


Omar al-Bayoumi is a Saudi Arabian national who came to the United 
States in 1993. In early 2000 he had been living with his wife and four 
children in San Diego for at least four years. Although he described himself to 
others in San Diego as a graduate student in business administration, he took 
classes intermittently and was not enrolled in a program of study. He did not 
work in the United States and received a monthly stipend of $4,000 plus “other 
allowances,” ranging from $465 to $3,800 each month, from Dallah/Avco, a 
Saudi contractor to the Presidency of Civil Aviation.'*’ Bayoumi was active in 
the San Diego Muslim community and was involved in the establishment of 
several mosques in the United States. 


In September 1998, the FBI’s San Diego Field Office opened a 
preliminary inquiry on Bayoumi based on allegations raised by the manager in 
the apartment complex where he was living at the time. The manager alleged 
that Bayoumi had received a suspicious package from the Middle East, and the 
maintenance worker for the apartment complex had noted strange wires in 
Bayoumi’s bathroom. In addition, the manager reported frequent gatherings of 
young Middle Eastern males at Bayoumi’s apartment on weekend nights. 


The FBI case agent conducted a limited investigation of Bayoumi, but the 
preliminary inquiry was closed in June 1999 and was not converted to a full 


187 Bayoumi was employed by the Saudi Presidency of Civil Aviation from 1975 until 


1995 and became a contractor for the organization beginning in 1995. 
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field investigation.'® As a result, the FBI was no longer investigating 


Bayoumi at the time that Hazmi and Mihdhar met Bayoumi in February 2000. 
However, the following paragraphs describe what was later learned about 
Bayoumi’s interactions with Hazmi and Mihdhar. 


On February 1, 2000, Bayoumi traveled by car from San Diego to Los 
Angeles, to resolve a visa issue at the Saudi consulate. Bayoumi invited an 
associate, Isamu Dyson, to accompany him.’ Dyson provided the following 
account to the FBI of the trip with Bayoumi.'”° 


Dyson said that at the time of the invitation, Bayoumi mentioned a Los 
Angeles restaurant serving halal food where they could eat lunch after 
Bayoumi’s meeting at the consulate.'*' After Bayoumi spent approximately 
one hour at the Saudi consulate, he and Dyson went to the restaurant but 
discovered it had been converted to a butcher shop. The butcher shop 
employees recommended another nearby halal restaurant, the “Mediterranean 
Gourmet.” Bayoumi and Dyson walked to that restaurant. While they were 
eating there, Hazmi and Mihdhar entered the restaurant and the four talked in 
Arabic. Although Dyson had limited Arabic language skills, he said that 
Bayoumi kept him apprised of the content of the conversation. Hazmi and 
Mihdhar told Bayoumi that they were in the United States to study English, but 
they did not like living in Los Angeles. Bayoumi invited the men to visit San 
Diego and offered to assist them. Bayoumi provided the men with his phone 
number. Bayoumi and Dyson left the restaurant, and after stopping at a nearby 
mosque for sunset prayers, returned to San Diego. Dyson asserted that the 
encounter with Hazmi and Mihdhar seemed to be a coincidental meeting. 


Within several days of the meeting, Hazmi and Mihdhar accepted 
Bayoumi’s invitation and traveled to San Diego. In San Diego, Bayoumi 


188 Tn Section IV B 1 of this chapter, we examine the investigative steps taken by the 


FBI in this preliminary inquiry and assess the appropriateness of the decision to close the 
inquiry. 


18 Dyson is an American Caucasian who converted to Islam. He has since changed his 


name to Caysan Bin Don. 


1% Dyson provided the information to the FBI in an interview after September 11. 


191 Halal is an Arabic word meaning “lawful” or “permitted.” 
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arranged for Hazmi and Mihdhar to rent an apartment on Mount Ada road in 
the same apartment complex where Bayoumi lived. Bayoumi also co-signed 
their lease. Shortly after Hazmi and Mihdhar moved into the apartment, 
Bayoumi hosted a party to introduce them to the local Muslim community. 


Within a few weeks of moving into the apartment, Hazmi and Mihdhar 
filed a 30-day notice to vacate the apartment, apparently to move to another 
apartment. However, they later rescinded the vacate notice and continued to 
lease the apartment until June 2, 2000." 


The apartment manager told the FBI that Bayoumi paid Hazmi and 
Mihdhar’s first month’s rent and security deposit because they had not yet 
established a local bank account and the apartment complex would not accept 
cash. A review of Bayoumi and Mihdhar’s financial records after September 
11, 2001, indicate that Bayoumi was reimbursed for this expense on the same 
day it was paid.” 


3. Hazmi and Mihdhar’s communications 


On March 20, 2000, a long distance telephone call was placed from 
Mihdhar and Hazmi’s Mount Ada apartment to a suspected terrorist facility in 
the Middle East linked to al Qaeda activities. (See section III, A, 2 above.) A 
record of the call was captured in the toll records. After the September 11 
attacks, the call was identified through a record check. 


192 Bayoumi left the United States for some of the time Hazmi and Mihdhar lived in the 


apartment. INS records do not indicate when Bayoumi left the country, but the records 
indicate that he obtained a United States visa in Jeddah on May 10, 2000, and returned to the 
United States on May 31, 2000. Bayoumi left the United States permanently in July 2001 
and was living in England on September 11, 2001. 


193 Bayoumi’s bank records show a cash deposit in the exact amount of the rent and 


security deposit ($1,558). Mihdhar’s financial records also indicate that he opened an 
account with a deposit of $9,900 in cash within seven minutes of Bayoumi’s cash deposit, 
which suggests that they were in the bank together. 
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4. Hazmi and Mihdhar’s association with an FBI asset 
beginning in May 2000 


Sometime in May 2000, Hazmi and Mihdhar moved out of the apartment 
Bayoumi had found for them on Mount Ada Road and moved as boarders into 
the home of an asset of the FBI’s San Diego Field Office." Hazmi and 
Mihdhar met the asset at the mosque they attended.’ Mihdhar stayed at the 
asset’s residence until June 10, 2000, when he left the United States. Hazmi 
resided in the asset’s house until December 10, 2000, when he moved to 
Arizona. 


a. Background on the FBI asset 


In 1994, the asset was recruited by San Diego FBI Special Agent who we 
call “Stan.” The FBI had interviewed the asset in connection with a bombing 
investigation several years before. Stan remained the asset’s handling agent — 
or “control agent” — until Stan retired in February 2002." 


The asset was opened as an asset on May 14, 1994."°’ He worked as an 
informational source, providing to the FBI information acquired in his normal 
daily routine. He normally was questioned about specific individuals who 
were under investigation by the FBI, although he occasionally volunteered 
information that he thought might be relevant. According to Stan, during some 


194 The OIG was not able to interview the asset. The Joint Intelligence Committee 


Inquiry had attempted to interview the asset without success. The Committee then 
submitted interrogatories that the asset declined to answer, asserting his Fifth Amendment 
privilege. The asset indicated through his attorney that if subpoenaed by the Committee, he 
would not testify without a grant of immunity. 


195 There is some dispute about whether Hazmi and Mihdhar actually responded to an 


advertisement for boarders posted by the asset or whether they were introduced to the asset. 
The OIG did not have access to the witnesses who could address this issue. 


196 Stan was interviewed twice by the JICI staff, and he testified before the Joint 


Intelligence Committee. After his retirement from the FBI, Stan declined repeated requests 
for an OIG interview. The OIG does not have authority to subpoena individuals and cannot 
compel former Department of Justice employees to submit to an interview. 


197 Initially the asset was not paid. In July 2003, the asset was given a $100,000 


payment and closed as an asset. 
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periods, he would talk to the asset several times per day, but there were periods 
in which he did not talk to him for several weeks or months. Stan said that 
many of their conversations were about family matters, the informational 
asset’s health, and other non-substantive issues. 


In 1996, the asset began renting out rooms in his home. Prior to 
September 11, 2001, he had 14 different boarders in his house, including 
Hazmi and Mihdhar. When Hazmi and Mihdhar rented rooms from the asset in 
2000, two other persons also were renting rooms there. 


b. Information from asset on Hazmi and Mihdhar 


It is not clear what information the asset provided to the FBI about 
Hazmi and Mihdhar before the September 11 attacks. 


After the September 11 attacks, the FBI interviewed the asset and asked 
about the conduct and activities of Hazmi and Mihdhar while they were living 
with the asset. In those interviews, the asset described them as quiet tenants 
who paid their rent. He said they were good Muslims who regularly prayed at 
the mosque. The asset said that Hazmi and Mihdhar often would go outside 
when using their cellular telephones. The asset insisted that he noted no 
indicators of nefarious activity by Hazmi or Mihdhar that should have resulted 
in his reporting their identities to the FBI.” 


The asset was asked what information he provided to Stan about Hazmi 
and Mihdhar before September 11. In these interviews, the asset provided 
conflicting accounts regarding the information on Hazmi and Mihdhar that he 
had disclosed to Stan. The agent who interviewed the asset - this agent had 
taken over as the asset’s control agent after Stan’s retirement from the FBI - 
told us that the asset said he told Stan about his boarders in general terms, 
although he had not fully identified Hazmi and Mihdhar. The control agent 
said that the asset later said that he had not told Stan about the boarders at all. 


198 The FBI opened an investigation after September 11 to determine whether the asset 


was involved in the attack. The asset has consistently maintained after September 11 that he 
had no suspicions about Hazmi and Mihdhar. The results of a polygraph examination on his 
potential role were inconclusive. Based on its investigation, however, the San Diego FBI 
concluded that the informational asset had not been complicit in plotting the attacks. 
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Although Stan declined to be interviewed by the OIG, after 
September 11, his FBI supervisors had interviewed him about the asset. Stan 
also had discussed the asset with co-workers and was interviewed by, and 
subsequently testified in, a closed session before the Joint Intelligence 
Committee.” Stan reported that the asset had told him contemporaneously 
that two Saudi national visitors were residing in a room at his residence. Stan 
said that the asset merely provided the first names of the boarders, Nawaf and 
Khalid. Stan contended that he had asked the asset for the boarders’ last names 
but never received them and did not follow up. He said that the asset told him 
that his boarders were in the U.S. on valid visitors’ visas, and they planned to 
visit and to study while they were in the country. In addition, Stan said that the 
asset told him that he believed that the two boarders were good Muslims 
because of the amount of time that they spent at the mosque. Stan stated that 
he did not recall the asset ever telling him that either of the boarders had 
moved out. According to Stan, the asset did not describe his boarders as 
suspicious or otherwise worthy of further scrutiny. Stan reported that he never 
obtained Hazmi and Mihdhar’s full identities from the asset and that he did not 
conduct any investigation of them. 


5. OIG conclusion 


In sum, the FBI did not obtain information about Mihdhar’s and Hazmi’s 
time in San Diego, either as a result of the Bayoumi preliminary inquiry or 
from the asset. In the analysis section of this chapter, we evaluate Stan’s 
actions with regard to Hazmi and Mihdhar and whether he should have pursued 
additional information about who was living with one of his assets. 


C. Mihdhar’s association with Khallad, the purported mastermind 
of the Cole attack 


The third potential opportunity for the FBI to acquire information about 
Hazmi and Mihdhar occurred in January 2001, when a joint FBI/CIA source 
identified an al Qaeda operative in photographs of the January 2000 Malaysia 
meetings that Hazmi and Mihdhar had attended. However, the FBI has 


19 The OIG was permitted to review the transcripts of Stan’s testimony before the Joint 


Intelligence Committee’s Inquiry. 
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asserted that it did not learn of the source’s identification of the al Qaeda 
operative at the Malaysia meetings until much later in 2001, just before the 
September 11 attacks. This section of the report describes the events 
surrounding this third opportunity for the FBI to focus on Hazmi and Mihdhar. 


1. Background 


In 2000, the CIA and the FBI began debriefing a source who provided 
significant information on operatives and operations related to Usama Bin 
Laden. The source gave the CIA and the FBI information about an al Qaeda 
operative known as “Khallad” and described him as being involved with the 
East African embassy bombings in August 1998. Shortly after the U.S.S. Cole 
was attacked in October 2000, the CIA and the FBI received a photograph and 
information that a man named “Khallad” was the purported mastermind behind 
the attack on the Cole. In December 2000, the CIA and the FBI showed the 
source the photograph of Khallad, and the source identified the person in the 
photograph as the same Khallad he had described as involved with the East 
African bombings. As part of the Cole investigation, the FBI sought to find 
Khallad. 


In January 2001, the source was shown photographs from the Malaysia 
meetings in an effort to determine whether Khallad was in the photographs. 
The source identified Khallad in one of the photographs, thus connecting the 
purported mastermind of the attack on the Cole with the Malaysia meetings 
known to have been attended by Mihdhar and others.” 


FBI officials told the OIG, however, that the FBI was not aware of the 
identification of Khallad in the Kuala Lumpur photographs. The FBI officials 
said that if they had known that Khallad — the purported mastermind of the 
Cole attack who they were seeking to find — was identified in the Kuala 
Lumpur photographs, they would have aggressively pursued information on the 
circumstances of the Malaysia meetings and the other participants, including 
Mihdhar. As a result, they said, they may have uncovered earlier the CIA’s 


200 Information developed after September 11, 2001, revealed this was a 


misidentification, and the person identified as Khallad was actually Hazmi. We discuss this 
misidentification in detail below. 
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information about Mihdhar and Hazmi and found them in the United States 
well before the summer of 2001. 


On the other hand, the CIA has contended the FBI in fact was aware in 
January 2001 of the source’s identification of Khallad from the Kuala Lumpur 
surveillance photographs. For example, on September 26, 2002, Cofer Black, 
who served as Director of the CIA’s CTC from 1999 until May 2002, testified 
before the Joint Intelligence Committee: 


FBI agents and analysts had full access to information [the 
CIA] acquired about the Cole attack. For example, we ran a 
joint operation with the FBI to determine if a Cole suspect was 
in a Kuala Lumpur surveillance photo. I want to repeat — it was 
a joint operation. The FBI had access to that information from 
the beginning. More specifically, our records establish that the 
Special Agents from the FBI’s New York Field Office who were 
investigating the USS Cole attack reviewed the information 
about the Kuala Lumpur photo in late January 2001. 


We therefore examine in detail the evidence relating to whether the FBI 
was aware of the identification of Khallad in the photographs of the Malaysia 
meetings. 


2. Source’s identification of Khallad 


a. Thesource 


In mid-2000, Drug Enforcement Administration (DEA) personnel 
arranged for FBI Legal Attaché (Legat) Office personnel overseas to meet a 
source who had substantial information on Bin Laden and his operatives and 
operations. This particular FBI Legat office was staffed by the Legal Attaché 
(the “Legat”) and the Assistant Legal Attaché (the ALAT), who were FBI 
Special Agents.” 


201 The primary mission of FBI Legat Offices is to establish liaison with foreign law 
enforcement agencies to support the FBI’s investigative activities overseas. While Legat 
staff may become involved in specific investigations, they have no law enforcement 
authority in foreign countries. For a description of the role and responsibilities of FBI 
(continued) 
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Because of the FBI Legat personnel’s inability to converse in any of the 
source’s languages, limits on the FBI’s authority to conduct unilateral 
intelligence activities overseas, and the source’s potential value as a source of 
intelligence information relevant to the CIA, the FBI contacted the CIA for 
assistance with the source. The source was subsequently handled as a joint 
FBI/CIA source. Even though the FBI ALAT — who we call “Max” — was 
unable to directly communicate with the source due to the lack of a common 
language, he was designated as the FBI control agent for the source. 


Because the source had significant information about Bin Laden and his 
operatives and operations, the FBI New York Field Office — the office that was 
leading the investigations on the East African embassy bombings, the Cole 
attack, and other Bin Laden-related investigations — also became involved with 
the source. This joint handling of the source created concerns within the CIA. 
The CIA’s most significant concern was the FBI’s desire to use the source for 
the criminal investigations involving Bin Laden conducted by the FBI’s New 
York Field Office. The CIA believed that the source should not face possible 
exposure in criminal proceedings. 


CIA Headquarters was asked to work with FBI Headquarters to convert 
the source to purely an intelligence role, solely under CIA control. According 
to CIA documents, the CIA and the Legat had discussed the FBI’s “wall” 
whereby separate but concurrent intelligence and criminal investigations were 
conducted within the FBI, but the CIA expressed concerns about the CIA’s 
ability to continue clandestine handling of the source if the FBI was involved. 
Although the CIA acknowledged that the source had value to the FBI’s 
criminal case, the CIA argued that the source’s potential as an intelligence 
asset was more important then his potential assistance in the criminal case. 
Despite the CIA’s concerns, the source remained a joint FBI/CIA asset. 


b. Debriefings of the source 


Beginning in 2000, the CIA and FBI began to debrief the source on a 
regular basis. Over the course of several months, the source frequently was 


(continued) 
Legats, see the OIG report entitled, “Federal Bureau of Investigation Legal Attaché 
Program” (March 2004). 
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shown photographs and asked to identify people in them. Although Max was 
the source’s designated control agent, a CIA officer who spoke one of the 
source’s languages conducted the debriefings. Max was present for some of 
these debriefings, but not all. Some of the debriefings were unilateral CIA 
interviews. The time spent with the source was kept short because of issues of 
travel and security. 


According to Max, during the debriefings the CIA officer usually did not 
immediately translate the source’s statements for the benefit of Max. He said 
that the CIA case officer would only immediately translate something when 
Max had specific questions for the CIA officer to ask the source. The CIA case 
officer told the OIG he recalled translating for Max things that the source said, 
but he did this only when he recognized the significance of the information to 
Max or an FBI operation. 


In an effort not to duplicate the reporting of information received from 
the source, the CIA and the FBI agreed that the CIA would be responsible for 
reporting the information from the debriefings. However, in instances where 
the source was solely being shown FBI photographs or questioned based on an 
FBI lead, Max would document the source’s information, either in an EC or an 
FBI FD-302 form, and the CIA would not document the same information. 


After the debriefings, the CIA officer would write internal cables 
covering the debriefings and forward them to the CTC and other appropriate 
offices. These cables were internal CIA communications and were not 
provided to or shared with Max or other FBI personnel.” Instead, Max and 
FBI Headquarters would be informed of the debriefings when the information 
was reported by the CIA ina TD. As previously discussed, TDs were prepared 
by CIA reports officers who reviewed the internal cables and determined what 
information needed to be disseminated and to which agencies. Based on our 
review of internal cables reporting the source’s debriefings and the TD 
reporting of the same interviews, it is clear the TDs often contained only a part 
of the information obtained during the source debriefings. As a result, either 


202 As discussed above, FBI detailees to the CTC had access to these CIA cables, but the 


review and dissemination of source information to the FBI was not considered their 
responsibility. 
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through direct knowledge or through the TDs, Max had access to only some of 
the information obtained from the source during the debriefings. 


In addition to the debriefings of the source by the CIA case officer, FBI 
agents from the New York Field Office working Bin Laden-related criminal 
investigations also interviewed the source with the CIA case officer present. 
Max occasionally was present for these interviews. After each of these 
interviews, the New York agents documented the source’s information in detail 
in an FD-302 that was entered into ACS and retrievable by all FBI personnel 
working on the Bin Laden cases.*” These FD-302s were routinely shared with 
CIA personnel in the field and at the CTC. 


c. Source identifies Khallad from Yemeni-provided 
photograph 


Over a 3-month period in 2000, FBI New York Field Office personnel 
interviewed the source overseas four times. During one of these interviews, the 
source described an individual known as “Khallad” as a trusted senior Bin 
Laden operative with potential connections to the East African embassy 
bombings. 


As noted above, on October 12, 2000, two terrorists in a boat laden with 
explosives committed a suicide attack on the U.S.S. Cole, a U.S. naval 
destroyer, during its brief refueling stop in the port in Aden, Yemen. The 
FBI’s investigation into the attack was led by the FBI’s New York Field 
Office. 


After the attack on October 12, the Yemenis provided the FBI and the 
CIA with information on the Bin Laden operative known as “Khallad.” 
According to this information, Khallad had been described as the purported 
mastermind of the Cole attack. U.S. intelligence agencies had already 


203 When a witness is interviewed as part of a criminal investigation, the FBI prepares 


an FD-302 to document what was said in the interview. When information is being obtained 
as part of an intelligence investigation, the FBI documents the information in an EC. There 
was Often a significant lag time between the interview and the completion of the 
documentation due to a variety of factors, including the intensity of investigative activity, 
the agents’ extensive travel, and the required review of the documentation by FBI 
supervisors before dissemination. 
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connected Khallad to the East African embassy bombings. The Yemenis also 
identified “Khallad” as Tawfiq Muhammad Salih Bin Rashid al Atash. On 
November 22, 2000, the Yeminis provided the FBI with a photograph of 
Khallad (“the Yemeni-provided photograph”). Around this same time, the 
Yemenis provided the FBI with several photographs of other Cole suspects. 


The New York FBI agents investigating the Cole bombing wanted to 
determine whether the Khallad identified by the Yemenis was the same 
Khallad who had been previously described by the source. At the same time, a 
CIA internal cable to was sent to several CIA offices suggesting that the 
photographs of the Cole suspects that the FBI had obtained from the Yemenis, 
including the Khallad photograph, be shown to the source. Because the FBI 
did not have the technological capability to easily transmit the Khallad 
photograph from Yemen to the ALAT who was handling the source and who 
we Call Max, the photograph was forwarded through CIA channels to the 
nearby CIA office in order to show the photograph to the source.” 


CIA documents show that on December 16, 2000, the CIA officer 
conducted a debriefing of the source. Max was present for the debriefing. 
During the debriefing, the CIA case officer showed the source many photos of 
Cole bombing suspects and other suspected Arab terrorists, including the 
Yemeni-provided photograph of Khallad. The source immediately identified 
the individual in the Yemeni-provided photograph as the same Khallad he had 
previously described as a trusted senior Bin Laden operative with potential 
connections to the East African embassy bombings. 
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The CIA officer prepared a cable documenting the debriefing, which was 
addressed to several CIA offices. The CIA officer wrote in the cable that the 
source was shown the many photographs and “quickly” identified Khallad in 


204 Max told the OIG that at the time he and the CIA case officer believed that this 


photograph had come from the FBI’s New York Field Office. Max added that it was not 
uncommon for him not to know the source of photographs that were shown to the source 
and that the source was shown hundreds of photographs. 


205 Although FBI agents from New York had traveled overseas several times in 2000 to 


interview the source, in December 2000 the agents with the appropriate language abilities 
were tied up in Yemen after the Cole attack and were unable to travel to debrief the source. 
Therefore, the FBI relied on the CIA to conduct this debriefing. 
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the Yemeni-provided photograph. Notably, the CIA cable stated that the CIA 
officer had the source repeat the identification specifically for the benefit of 
Max. In addition, the cable stated that before the debriefing ended, the CIA 
officer again showed the photographs to the source and asked the source to 
verify the Khallad identification. 


Max acknowledged to the OIG that he was contemporaneously aware of 
the identification of Khallad in the Yemeni-provided photograph by the source 
on December 16. Max stated that he recalled specific circumstances of the 
debriefing and recounted them to us. Max told us that he recalled the source 
immediately identifying Khallad in the photograph. 


d. CIA suspects that Khallad may be Mihdhar in Kuala 
Lumpur surveillance photographs 


Around this same time, CIA personnel were beginning to connect 
Khallad with Mihdhar and the January 2000 Malaysia meetings. Ina 
December 2000 cable, CIA personnel overseas asked for copies of the January 
2000 Kuala Lumpur surveillance photographs of Mihdhar. The cable noted 
that further connections had been made between Mihdhar and Al Qaeda. Asa 
result of these further connections, the CIA believed there might be a 
connection between Mihdhar and the Cole perpetrators. 


The CIA office reported in the December 2000 cable that the it had 
learned that Fahd al Quso, who was in Yemeni custody for his participation in 
the Cole attack, had received $7,000 from someone named Ibrahim, which 
Quso had taken to Bangkok, Thailand, on January 6, 2000, to deliver to 
“Khallad,” a friend of Ibrahim’s. It was noted in the cable that because 
Mihdhar had departed Kuala Lumpur around that same time to travel to 
Bangkok, the CIA suspected that the “Khallad” mentioned by Quso could 
actually be Khalid al Mihdhar or one of his associates.” It was noted further 
that this information had “added significance” because Khallad had been 


206 As previously discussed, the CIA had reported previously in an internal March 2000 


cable that Mihdhar, Hazmi, and another individual had left Malaysia on January 8, 2000, 
and traveled together to Bangkok. 


269 


identified as a “key operative likely serving as an intermediary between Usama 
Bin Laden and the [Cole] perpetrators.” 


In another December 2000, cable the CTC concurred with the overseas 
CIA office’s theory and forwarded a Kuala Lumpur surveillance photo of 
Mihdhar to the CIA case officer to show to the source. According to the cable, 
the purpose was “to confirm/rule out this particular Khalid [Mihdhar] as a 
match for [Khallad].”?” The next day, the CIA officer received permission to 
show the Kuala Lumpur surveillance photographs to the source. 


Max told the OIG, however, that he was not aware of the CIA cables or 
the theory that Khallad was actually Mihdhar. We found no other evidence 
that Max knew about the information that Mihdhar was at the Malaysia 
meetings, or the CIA’s theory that Khallad was actually Mihdhar.*™ 


e. Source identifies Khallad from Kuala Lumpur 
photograph 


The CIA case officer debriefed the source again in early January 2001. 
At some point, the CIA case officer showed the source photographs, including 
two of the surveillance photographs taken during the January 2000 Malaysia 
meetings. One of the photographs from the Malaysia meetings, which we call 


207 The CIA cable referred to its forwarding of only one Kuala Lumpur surveillance 


photograph, although subsequent cables showed that the receiving office received two Kuala 
Lumpur photographs to show the source. It is unclear why the sending office sent only two 
of the photographs instead of all three of the Kuala Lumpur photographs it had. 


*° Tn fact, CIA cables suggest this information was not shared with the FBI. We saw 


several CIA cables during this time that discussed working with the FBI in relation to the 
FBI’s investigation of the Cole attack. For example, we saw a December 2000 cable stating 
that the FBI had provided an update on its investigation of the location associated with 
telephone numbers the CIA had provided to the FBI in connection with an investigation, and 
the office that drafted the cable asked to be advised of whether the two offices to whom the 
cable was addressed were aware of additional information that could assist the FBI. 
However, we saw another December 2000 cable, which discusses Khallad and other 
information not related to Khallad, which specifically instructed two CIA offices to share 
with the FBI the other information in the cable that was not related to Khallad, but it did not 
instruct the offices to share the information regarding the possible connection of the 
Malaysia meetings and Khallad. 
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“Photo No. 1” included an unknown subject. The source identified one of the 
individuals in this photograph as Khallad. According to a January 2001, cable 
written by the CIA case officer, the source was asked if he was sure, and he 
replied that he was “ninety percent” certain.*” 


The second photograph from the Malaysia meetings, which we call 
“Photo No. 2,” contained a picture of the person the CIA knew to be Mihdhar. 
The source could not identify the person in the photograph.*’° 


However, the source’s identification of Khallad in the first photograph 
was significant. First, the source previously provided information that Khallad 
was a Bin Laden operative who was connected to the Cole attack and the East 
African embassy bombings. Second, as a result of the identification, it was 
suspected that Khallad was at the Malaysia meetings along with other 
suspected al Qaeda operatives. From other information, it also was known that 
Mihdhar was at the meetings, and it was suspected that Hazmi was there also. 
Thus, the source’s identification of Khallad at the Malaysia meetings raised the 
question whether Mihdhar and Hazmi also were linked to the Cole attack. 


We tried to determine if the FBI’s ALAT learned of the source’s 
identification of Khallad in the photograph. Max told the OIG that he did not 
specifically recall the early January 2001 debriefing of the source. He stated he 
also did not recall being aware of any early January 2001 identification of 
Khallad from the Kuala Lumpur surveillance photographs. In addition, Max 
asserted he was not aware of the Malaysia meetings and the photographs until 
he was questioned about them by the JICI staff on June 27, 2002. 


The CIA case officer told the OIG that he had no independent 
recollection of any particular meeting with the source, including the meeting in 
early January 2001. 


°° As noted above, information developed after September 11, 2001, revealed this was 


a misidentification, and the person identified as Khallad was actually Hazmi. 


210 This failure to identify Khallad in the photograph known to be of Mihdhar should 


have ended the theory that Mihdhar and Khallad were the same person. 


271 


f. Documentation regarding the source’s identification of 
Khallad in the early January 2001 debriefing 


(1) CIA cables 


To examine whether the FBI learned of the source’s identification of 
Khallad in the Kuala Lumpur photographs, we reviewed the CIA 
documentation concerning the meeting with the source in early January 2001. 
In an internal cable written the day after the debriefing, the CIA case officer 
reported that the source had identified Khallad in one of the Kuala Lumpur 
photographs with a “ninety percent” certainty. However, unlike in the 
December 2000 CIA cable, which stated that the CIA officer had the source 
repeat the identification of Khallad in the Yemeni-provided photograph to 
Max, the January 2001 cable did not suggest the identification was repeated for 
Max or was brought to the attention of Max. The January 2001 cable did not 
provide any other details about the debriefing, such as where the meeting took 
place, when exactly during the debriefing the photographs were shown to the 
source, who was present when the photographs were shown to the source, or 
what other topics were discussed with the source. 


We also reviewed a detailed January 2001 CIA TD to the Intelligence 
Community regarding the early January 2001 debriefing. The TD reported 
specifics about what the source discussed and that he had provided a stack of 
documents to his CIA and FBI handlers. The TD made no mention of any 
photographs being shown to the source or any identification of Khallad.*" 


A few days later, the CIA case officer wrote another cable describing the 
logistics of the early January 2001 meeting with the source. In addition, the 
cable summarized what was discussed during the meeting. This cable also did 
not mention the photographs being shown to or discussed with the source, but 
the CIA case officer told the OIG that these kinds of cables were not always 
comprehensive with respect to the information obtained from the source. 


211 Although no witness can recall the details of this particular debriefing, it is possible 


that Max, who lacked the appropriate language skills for a debriefing, either photocopied or 
hand wrote the information from the documents thus explaining his absence at the time that 
the photographs were shown to the source. 
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(2) FBI documents 


We also reviewed FBI documents from this period relating to the source. 
On January 9, 2001, a New York FBI agent who was the FBI’s lead case agent 
on the Cole investigation sent Max an e-mail stating that he and his co-case 
agent wanted to meet with the source to talk about some of the Cole suspects, 
including Khallad. The New York agent wrote that he was “specially [sic] 
interested in all [the source] knows about Khallad and his associates.” The 
agent noted that the source previously had given the agents important 
information regarding Khallad and the Cole attack. 


In a January 10 e-mail response, Max referred to the December 16 
meeting with the source in which the source had been shown many 
photographs and had immediately identified the Yemeni-provided photograph 
as Khallad. Max also mentioned the early January 2001 meeting, summarizing 
specific information provided by the source in the debriefing. Max wrote that, 
due to the lack of technological capabilities in the Legat Office, he promised to 
make the CIA TD numbers relating to the source available to the case agent 
within a few days so the agent could read them before his trip to interview the 
source. However, Max made no mention of any identification of photographs 
by the source in the early January 2001 debriefing. 


Around the same time as this e-mail exchange, Max was criticized by the 
head of the FBI’s UBL Unit at Headquarters for insufficient reporting 
regarding the source’s information. The UBL Unit chief wanted to know from 
Max what information the source was providing. She also was concerned 
because Max was not producing any reports regarding the source. 


In response, on January 16, 2001, Max wrote a 34-page EC summarizing 
the source’s debriefings and other information obtained from the source since 
mid-2000, most of which was based on the information that had been 
disseminated in the TDs by the CIA. Max explained in the EC that he merely 
was repeating what the CIA had previously reported in TDs, which had already 
been forwarded to FBI Headquarters. He noted the agreement with the CIA 
that there would not be duplicative reporting on the source’s information. He 
explained the CIA was doing the primary reporting on the source debriefings 
Max noted that the interview was conducted in the foreign language, and he 
would read the CIA’s report of the interview (the TD) once it was completed. 
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Max then listed all of the CIA’s TDs that summarized what the source had 
said. 


On page 29 of this January 16 EC, Max summarized the CIA’s reporting 
of what had occurred at the December 16, 2000, meeting with the source. The 
EC stated the source was handed a stack of many photographs and immediately 
identified the top photograph as a photograph of Khallad, the person the source 
had previously implicated in the attack on the Cole. The EC stated, “At that 
time it was the clear impression of [the Legat] and [the CIA officer] that both 
FBIHQ CTD and NYO were receiving all of the reporting above from CIA 
liaison in the U.S., as soon as it was being filed.” 


In the next paragraph of the EC, Max summarized what the CIA had 
reported in the TD about the early January 2001 debriefing of the source. This 
summary is contained on pages 29 through 33 of the EC. Max reported at 
length about the source’s information, and the EC provided a lengthy 
description of the documents provided by the source. Again, there was no 
mention of any photographs from the Malaysia meetings or the identification 
of Khallad. 


Max discussed with the CIA case officer the complaint from FBI 
Headquarters about Max’s reporting on the source. As a result, the CIA case 
officer provided Max with a report of the next debriefing of the source in late 
January 2001. The day after this debriefing, Max prepared a lengthy EC 
summarizing this debriefing. He noted in the EC that the report was based on 
the CIA’s report of an interview conducted by a CIA officer and, although Max 
was present for the debriefing, he only became aware of what was said after the 
CIA officer provided the report.*” 


212 Around the same time, the CIA officer sent a cable to CIA Headquarters that 


described the FBI’s need for reporting directly through FBI channels, as opposed to CIA 
channels. The CIA office then asked permission to provide electronic copies of TDs to Max 
so that Max could send the same reporting through FBI channels. 
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g. New York FBI agents’ interview of source on February 
1, 2001 


Around the same time, Max was preparing for the arrival of the Cole case 
agent from the FBI’s New York Field Office. The Cole case agent was 
traveling to interview the source about Khallad, along with another FBI agent 
who spoke one of the languages of the source and was going to assist in the 
preparation of the FD-302 for the criminal investigation. Max had received a 
January 17 e-mail from one of the Cole agents stating that the information 
being provided by the source was very important to the FBI’s criminal 
investigation of the Cole attack and discussing the arrangements for the 
upcoming interview of the source by the Cole agents. 


The New York Cole agents also asked Max to prepare an FD-302 
documenting Max’s personal knowledge of the source’s identification of 
Khallad from the Yemeni-provided photograph on December 16. On January 
24, 2001, Max sent an EC to the New York Field Office and FBI Headquarters 
with an attached FD-302 regarding the source’s December 16, 2000, 
identification of Khallad. 


On February 1, 2001, the New York Cole case agent and another agent 
who spoke one of the source’s languages interviewed the source overseas.*”” 
The CIA case officer who had shown the Kuala Lumpur photographs to the 
source in early January was also present at the interview. During the interview, 
they showed the source the Yemeni-provided photograph of Khallad, which 
previously had been shown to the source by the CIA officer on December 16, 
2000. The source again identified Khallad in the photograph. 


As discussed above, the agents had received information indicating that 
Quso, who was in custody for his participation in the Cole attack, had traveled 
to Bangkok and met Khallad in January 2000. The New York agents were 
investigating the circumstances of that trip. The agents knew that Quso 
previously had claimed that he had intended to meet Khallad in Malaysia. The 


213 Tn anticipation of the Cole agents’ interview of the source, the CIA case officer had 


sent a cable asking the Bin Laden Unit to touch base with FBI Headquarters regarding the 
case status and the planned trip of the New York FBI agents. The CIA case officer noted 
that the source was “currently of very high interest to our [FBI] colleagues.” 
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agents were concerned about Quso’s veracity and whether Quso, as well as 
Khallad, had actually traveled to Malaysia. Therefore, an identification of 
Khallad in Malaysia during this period would have been very significant to the 
agents. 


Both FBI agents who participated in the February 1 debriefing of the 
source told the OIG that they were not informed about surveillance 
photographs of the Malaysia meetings, that they did not know such 
photographs existed, and that they did not show any such Kuala Lumpur 
photographs to the source. They stated that they were not told that the source 
had identified Khallad from a Kuala Lumpur surveillance photograph in early 
January. They added that if they had been aware of any such identification of 
Khallad, they would have wanted to have the source repeat the identification 
for them since Khallad was a subject in the Cole criminal investigation.” 
However, they stated that they were never informed of such an identification. 


3. OIG conclusions regarding whether the FBI was aware of 
the source’s identification of Khallad in the Kuala Lumpur 
photograph 


We concluded that the evidence shows that the FBI was not made aware 
that during the early January 2001 debriefing the source identified Khallad in 
the photographs of the Malaysia meetings. Max insisted in his interviews with 
us that he was unaware of this identification of Khallad and that he was not 
even aware of the existence of the Kuala Lumpur surveillance photographs 
until after the September 11 attacks. Neither Max nor the CIA case officer 
specifically recalled the early January debriefing, but the documentary 
evidence supports this conclusion. In numerous CIA and FBI documents 
discussing the source and the early January debriefing, other important 
information from the source is described, but the source’s identification of 
Khallad in the Kuala Lumpur photograph is never mentioned. Given the 
importance of that identification and the other details reported in the 


214 The CIA’s Review Group has also asserted that the FBI may have received the 
Kuala Lumpur photographs from another source. The CIA did not refer to any witnesses for 
this claim but instead referred to a series of CIA cables and FBI documents. Our review of 
the cables and other documentary evidence did not support this claim. 
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documents, we believe such information would have been included had the FBI 
been made aware of the identification. 


For example, as described above, in the CIA case officer’s cable 
reporting the December 16 debriefing of the source during which the source 
had identified Khallad in the Yemeni photograph, the CIA officer specifically 
noted that ALAT heard the identification and that the identification was 
repeated for the benefit of him. Max said he recalled this debriefing and the 
identification of Khallad being brought to his attention by the CIA case officer. 


By contrast, in his cable reporting the early January source debriefing, 
the CIA case officer did not state that he brought to the attention of Max the 
identification of Khallad in the Kuala Lumpur photographs. Likewise in his 
cable describing the logistics of the debriefing, the CIA case officer provided a 
description of what was discussed with the source and stated that Max was 
present for a significant portion of the meeting with the source, but did not 
mention any Kuala Lumpur photographs or that the CIA case officer had 
brought the identification of Khallad to the attention of Max. 


The documents prepared at the time by Max about the early January 
debriefing also suggest that Max was not aware of the identification of Khallad 
in the Kuala Lumpur photographs. For example, in response to the Cole case 
agent’s January 9 e-mail specifically requesting “all [the source] knows about 
Khallad,” Max did not include any information about the Khallad identification 
from the Kuala Lumpur photographs. This was shortly after the early January 
debriefing, and the case agent had specifically indicated his interest in any 
information about Khallad. 


Max’s January 16 EC to FBI Headquarters in which he described at 
length what the source had reported in the early January meeting also did not 
mention the identification of Khallad or that any Kuala Lumpur photographs 
were shown to the source. In addition, Max prepared an FD-302 to document 
the source’s identification of Khallad from the Yemeni photograph to provide 
documentation for the criminal investigation. We believe that if Max had 
known of the source’s identification of Khallad in the Kuala Lumpur photos, 
he likely would have prepared a similar FD-302 of that identification as well. 


We also found that the New York Field Office agents who interviewed 
the source overseas in February 2001 were not made aware of the early January 
identification of Khallad. The agents insisted that they were completely 
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unaware that any Kuala Lumpur surveillance photographs had been shown to 
the source or that the source had identified Khallad in any photographs other 
than the Yemeni-provided photograph. In addition, we found no documentary 
evidence that the New York FBI agents were even aware of the Malaysia 
meetings or the resulting surveillance photographs at the time they interviewed 
the source. Because the agents were keenly interested in Khallad and had 
asked the source to confirm his identification of Khallad from the Yemeni 
photograph, we believe the agents would have noted, remembered, and acted 
upon any information regarding another Khallad identification. We also 
believe that had the FBI known about the identification of Khallad in the Kuala 
Lumpur photographs, they would likely have sought information about the 
other participants in the meeting, including Mihdhar and Hazmi, which could 
have increased the FBI’s chances of locating them before the September 11 
attacks. 


Due to the OIG’s lack of complete access to CIA employees and 
documents, we were unable to fully examine why the CIA did not inform Max 
or the New York agents that the source had identified Khallad in the Kuala 
Lumpur photographs at the early January debriefing. We believe the FBI 
should have been made aware that the joint FBI/CIA source had provided such 
significant information about the person purported to be the mastermind behind 
the Cole attack. This failure demonstrated significant problems in 
communication between the FBI and the CIA. However, the FBI employees’ 
inaccurate belief that CIA reporting in TDs was comprehensive contributed to 
the FBI’s failure to obtain this critical piece of information. We discuss this 
and other systemic problems that this case revealed in the analysis section of 
this chapter. 


D. FBI and CIA discussions about the Cole investigation in May and 
June 2001 


The fourth opportunity for the FBI to have acquired intelligence 
information about Hazmi and Mihdhar — including Mihdhar’s possession of a 
U.S. visa, Hazmi’s travel to the United States, and the source’s identification of 
Khallad from the Kuala Lumpur photographs — occurred in May and June 2001 
when the CIA and FBI Headquarters discussed the status of their information 
concerning the Cole attack. Once again, these discussions could have caused 
the FBI and the CIA to focus on the other persons attending the Malaysia 
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meetings with Khallad, and thereby led the FBI to search for Mihdhar and 
Hazmi earlier than it did. But, as we describe below, the FBI did not obtain the 
critical information about the identification of Khallad at the Malaysia 
meetings, despite several interactions in May and June 2001 between the FBI 
and the CIA about Khallad. 


1. Background 


a. The Cole investigation 


As discussed above, the FBI’s investigation on the Cole attack was led by 
the FBI’s New York Field Office.” One of the case agents investigating the 
Cole attack was an agent who we call “Scott,” and who was assigned to the 
New York FBI’s counterterrorism squad that handled only al Qaeda 
investigations (the “Bin Laden squad”).*'° After serving eight years in the U.S. 
Navy as a fighter pilot, in April 1996 Scott became a special agent in the FBI’s 
New York Office. In July 1996 he was assigned to the TWA Flight 800 
investigation because of his experience as a military pilot. Shortly after the 
East African embassy bombings in August 1998, he was transferred to the New 
York’s Bin Laden squad to assist with the embassy bombings investigation, 
and then was assigned as one of the case agents on the investigation the Cole 
attack. 


The New York FBI was assisted on the Cole investigation by several 
Intelligence Operations Specialists (IOS) assigned to the UBL Unit and the 
Radical Fundamentalist Unit (RFU) at FBI Headquarters. 


One of the primary IOSs who worked on the Cole investigation was an 
IOS who we call “Donna.” She had joined the FBI in 1988 as a clerk while she 
completed her college education. After graduating from college in 1995, she 
entered the FBI’s language training program and became a Russian language 


215 Through their work on the 1993 attack on the World Trade Center and the 


subsequent discovery of the terrorist plot to attack New York landmarks, the New York FBI 
became the primary office for the investigation of al Qaeda, eventually leading to the 
indictment of Bin Laden in the Southern District of New York in November 1998. 


216 The other primary case agent on the Cole investigation was out of the country during 


the events discussed in this section of the report. 
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specialist working on foreign counterintelligence matters. In November 1997, 
she became an Intelligence Research Specialist (IRS), and a year later was 
assigned to assist the RFU on the East African embassy bombings 
investigation. In 2000 she was permanently assigned as an IOS in the UBL 
Unit and was assigned to work on the Cole investigation in October 2000. 


With regard to Donna’s work on the Cole investigation, she stated that 
she and the other UBL Unit IOSs conducted the investigation as directed by the 
New York Field Office, sent out requests for information to other law 
enforcement and intelligence agencies, obtained budget enhancements to 
support the investigation, and performed other duties in support of the 
investigation. She and the other UBL IOSs often traveled to New York where 
they met with the Cole agents and worked on the investigation. 


b. The wall and the caveat on NSA information 


The information relevant to this section of the report includes NSA 
information disseminated about Mihdhar in late 1999 and early 2000. As noted 
in Chapter Two, by the summer of 2001 NSA counterterrorism intelligence 
information could not be disseminated within the FBI without adhering to 
certain procedures and protocols. At this time, the FBI was required by the 
Department and the FISA Court to keep criminal investigations separate from 
intelligence investigations, a policy which was commonly referred to as “the 
wall.” Information obtained from FISA intercepts and search warrants had to 
be screened by someone not involved in the criminal investigation and then 
“passed over the wall” from the intelligence investigation to the criminal 
investigation. The FISA Court became the screening mechanism for FISA 
information obtained from al Qaeda intelligence investigations that the FBI 
wanted to pass to criminal investigators. 


As described in Chapter Two, in response to notification that there had 
been many errors in FISA applications approved by the FISA Court, the Court 
imposed additional restrictions before information could be shared. First, 
based on the FISA Court’s concerns about the errors in the FISA applications, 
the FBI directed that only intelligence agents were permitted to review FISA 
intercepts and materials seized pursuant to a FISA warrant (called “FISA- 
obtained material”) or any CIA and NSA intelligence provided to the FBI 
based on information obtained through FISA search or intercept (called “FISA- 
derived” material) without further Court approval. The Court required anyone 
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who reviewed the FISA-obtained or FISA-derived intelligence to sign a 
certification acknowledging that the Court’s approval was required for 
dissemination to criminal investigators. 


Because FISA-obtained information often was passed from the FBI to the 
NSA and the CIA, the question was raised to the FISA Court whether the FBI 
was required to obtain certifications from all NSA or CIA employees who 
reviewed the FISA-obtained material. The Court exempted the NSA and CIA 
from the certification but required that the two agencies note on any 
intelligence shared with the FBI if it was FISA-derived. This was referred to 
as “a caveat.” 


When made aware of this requirement, the NSA reported to the 
Department of Justice that for the NSA to determine in real-time which 
counterterrorism intelligence that it had acquired was FISA-derived would 
delay dissemination of the information. As a result, the NSA decided to 
indicate on all its counterterrorism intelligence provided to the FBI as being 
FISA-derived so that it could not be disseminated to criminal agents or 
prosecutors without approval from the NSA.*'” Therefore, when the FBI 
wanted to pass this NSA intelligence to criminal investigators, it had to contact 
the NSA General Counsel’s Office to determine whether the information was 
in fact FISA-derived before it could be passed.*" 


2. Discussions in May 2001 


In May 2001, the potential connection of Khallad to the Malaysia 
meetings was again discussed by CIA personnel. FBI personnel also discussed 
Khallad in reference to his nexus to the Cole attack. There were also 


217 According to the NSA, its average response time to FBI requests for approval to pass 


information to criminal investigators was one to five business days. 


218 The NSA information concerning Hazmi and Mihdhar was from late 1999 and early 


2000, and contained the initial caveat stating that information could not be disseminated to 
law enforcement officials without approval from OIPR. By the time FBI Headquarters was 
dealing with this information in the summer of 2001, the new caveat was being placed on 
NSA reporting, and FBI Headquarters was operating under the understanding that the NSA 
General Counsel had to approve dissemination of NSA counterterrorism information to 
criminal investigators. 
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discussions between the CIA and FBI in reference to the Kuala Lumpur 
photographs. But, as described below, the identification of Khallad in the 
Kuala Lumpur photographs and Khallad’s connection to other suspects, such as 
Hazmi and Mihdhar, were not addressed during these May discussions between 
the FBI and the CIA. 


a. John’s inquiries about Khallad 


Between the early January 2001 debriefing of the source and May 2001, 
the CIA’s focus on whether Khallad, the suspected mastermind behind the Cole 
attack, had attended the Malaysia meetings appears to have subsided. In May 
2001, John, a former Deputy Chief of the Bin Laden Unit, who by that time 
was detailed to ITOS in FBI Headquarters, had continuing concerns about the 
Malaysia meetings, especially whether they had any nexus to the Cole 
attack.” John also noted to the OIG that during this period there were 
heightened concerns in the Intelligence Community about the threat of an 
imminent terrorist attack in Southeast Asia. 


CIA records show that on May 15, 2001, John accessed the March 2000 
cable stating that Mihdhar, Hazmi, and another person had traveled to Bangkok 
from Malaysia on January 8, 2000. The cable also stated that Hazmi had left 
Bangkok on January 15, 2000, flying from Bangkok to Hong Kong and then to 
Los Angeles. 


Around this same time in May, John began inquiring about the Malaysia 
meetings with a CTC analyst, who we call “Peter,” at CIA Headquarters. John 
said he knew that Peter had been “down in the weeds” and knew the “nuts and 
bolts” of the Cole investigation because Peter had been assigned to prepare a 
CTC report on who was responsible for the Cole attack. 


Peter told the OIG that his area of expertise and focus since August 1999 
was the Arabian Peninsula. He said that because the Cole attack took place in 
Yemen, he was assigned to develop an intelligence report on who was 


219 John told the OIG that in this detail to the FBI he acted as the CIA’s chief 
intelligence representative to ITOS Section Chief Michael Rolince. John stated that he did 
not have line authority over anyone at the FBI and that his primary role was to assist the FBI 
in exploiting information for intelligence purposes. 
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responsible for the Cole attack. He completed his report in January 2001, 
finding that UBL/al Qaeda was circumstantially tied to the attack.*” Peter 
stated that while working on the Cole report he regularly interacted with the 
IOSs in the FBI’s UBL Unit. By the spring 2001, he was no longer working 
directly on the Cole attack, and had moved on to potential threats in Saudi 
Arabia and Yemen. However, Peter said he had a continued interest in the 
Cole information and continued to gather information on an ad hoc basis. 


According to John, he and Peter discussed the Malaysia meetings, and 
Peter provided him with a copy of the timeline of events related to the Cole 
investigation that Peter had compiled as part of his work on the Cole attack.*” 
In addition, John said they discussed Quso, a Cole perpetrator in Yemeni 
custody, and any connections Quso may have had with the individuals in 
Malaysia. John and Peter were aware that Quso had stated that he was 
supposed to take money to a person named “Khallad” in Malaysia but had met 
him in Bangkok instead in January 2000. John told the OIG that Peter had 
posited that perhaps Quso had gone to Malaysia and met with the others who 
had been observed there in January 2000, and therefore Quso might have been 
in one of the Kuala Lumpur photographs. 


In an e-mail to Peter in mid-May 2001, John noted that Mihdhar had 
arranged his travel to Malaysia and was associated with “[another terrorist 
organization] courier travel at the same time.” John also noted in the e-mail 
that Quso, who was believed to be a courier since he had stated he had traveled 
to take money to Khallad, had traveled a few days earlier than Mihdhar.*” In 
addition, John wrote that he was interested because Mihdhar was traveling with 
two “companions” who had left Malaysia and gone to Bangkok, Los Angeles, 
and Hong Kong and “also were couriers of a sort.” John noted in the e-mail 


220 The report did not mention Mihdhar’s visa, Hazmi’s travel to the United States or the 


Khallad identification from the Kuala Lumpur photographs. 


221 The timeline did not mention the Kuala Lumpur photographs, Mihdhar’s U.S. visa, 


or Hazmi’s subsequent travel to the United States. 


222 As previously discussed, after Quso was detained in Yemen, he acknowledged that 


he had received $7,000 from someone named Ibrahim, which Quso asserted he took to 
Bangkok, Thailand on January 6, 2000, to deliver to “Khallad,” a friend of Ibrahim’s. 
Mihdhar had traveled to Bangkok on January 8. 
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that “something bad was definitely up.” Peter replied in an e-mail dated May 
18, “My head is spinning over this East Asia travel. Do you know if anyone in 
[the CIA’s Bin Laden Unit] or FBI mapped this?” 


b. Discussions among FBI and CIA employees 


Around this same time, FBI IOS Donna and other FBI IOSs working on 
the Cole investigation were focusing on Quso’s connection to Bangkok and his 
trip to deliver money to Khallad. The FBI, like the CIA, was aware that in 
January 2000 Quso had planned to travel to Malaysia to take money to 
Khallad. According to an FBI document drafted by Donna in May 2001, Quso 
had claimed that on January 6, 2000, he and Ibrahim Al-Nibras went to 
Bangkok first but were unable to travel on to Kuala Lumpur because of 
problems with their travel documents, and Khallad had traveled to Bangkok to 
meet them there instead. The FBI began researching telephone numbers that 
appeared to be connected to Quso’s trip and requested that several Legat 
Offices contact local law enforcement authorities to obtain subscriber 
information. 


Donna told the OIG that she and others were tracking the information 
related to the telephone numbers associated with Quso in an attempt to 
determine the truth of his statements. In addition, she said that she was focused 
on the identity and whereabouts of Khallad, since he was the purported 
mastermind of the Cole attack. 


At some point before the end of May 2001, John discussed with Donna 
the East Asian travel of Quso. In response to Peter’s May 18 e-mail that asked 
whether anyone had “mapped” the East Asia travel, John replied in an undated 
e-mail that “key travel still needs to be mapped” and stated “[Donna] sounds 
really interested in comparing notes in a small forum expert to expert so both 
sides can shake this thing and see what gaps are common.” 


In addition to reviewing the East Asia travel of several Bin Laden 
operatives in January 2000, John also began looking in CIA records for the 
Kuala Lumpur photographs. John obtained three of them. John told the OIG 
that he had not read the cable stating that the joint source had identified 
Khallad in the photographs, but he was aware that an identification of Khallad 
in the photographs had been made. At the end of his e-mail to Peter, John 
stated that he had obtained three surveillance photographs of Mihdhar in 
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Malaysia, but he did not see “Khallad” in any of the photographs, and he 
believed he was “missing something” or “someone saw something that wasn’t 
there.” John also questioned whether there was a cable somewhere that 
documented the identification of Khallad.*” 


In response to John’s e-mail, Peter wrote in an e-mail dated May 24 that 
he had thought one of the Kuala Lumpur photos was of Khallad. Peter added 
that Donna and another FBI IOS in the UBL Unit, who we call “Kathy,” were 
meeting with Peter on May 29 to discuss the Cole investigation. Peter 
suggested that he could raise the issue of the Kuala Lumpur photographs and 
the possible identification of Khallad with the FBI IOSs. Peter told the OIG 
that he had learned about the source’s identification of Khallad in the Kuala 
Lumpur photographs when it had occurred, but by May of 2001 it had been 
several months since he had worked on the Cole matter and he could not recall 
whether Khallad had been identified in the photographs. 


On May 24, Donna sent John an e-mail stating that a meeting with Peter 
and others was “tentatively scheduled” for May 29 for “an in depth discussion 
about the Cole.” 


We were unable to determine with certainty whether a meeting with 
Peter, Donna, and Kathy actually took place on May 29. None of the witnesses 
had notes of any such meeting, nor were there any e-mails discussing the 
meeting after it would have taken place. The witnesses told the OIG that they 
could not recall whether a meeting took place on May 29. For example, when 
asked whether she knew Peter, Kathy told the OIG that his name sounded 
familiar and that she may have met him, but she did not recall a meeting on 
May 29, 2001, about the Cole investigation. A May 29 e-mail from Peter to 
Mary indicates that he met with Mary earlier in the day, but it does not identify 
the other participants or what was discussed. 


*°3 As noted above, John was correct — Khallad was not in any of these three 


photographs. After September 11 it was learned that the person the source had identified as 
Khallad was actually Hazmi. It was also learned after September 11, however, that Khallad 
was in another Kuala Lumpur surveillance photograph that had not been shown to the 
source. 
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However, it is clear that at some point before the end of May 2001, 
Donna became aware of the existence of the Kuala Lumpur photographs in 
January 2000. Donna told the OIG that she recalled John printing one of the 
CIA photographs on the printer in his office at FBI Headquarters, and Donna 
acknowledged that she obtained two other Kuala Lumpur photographs from 
him. According to Donna, Peter had raised the photographs in a discussion 
with her prior to her obtaining the photographs from John, although she said 
that she did not recall the details of their discussion about the photographs. 
Donna said she did recall that, at the time, Peter had posited that one of the 
photographs could relate to Quso, which if true would contradict Quso’s 
statements about going only to Bangkok and not going to Malaysia. According 
to Donna, the FBI was attempting to determine the veracity of Quso’s 
information, so the photographs potentially were connected to the Cole 
investigation. She stated, however, that outside of this potential connection, 
the photographs were “another piece of a thousand things coming in” at the 
time. She said that if Quso were determined to be in the photographs, then the 
photographs would have become significant to the Cole investigation. 


Donna also told the OIG that she did not recall a “substantive 
conversation” with John about the photographs or the Malaysia meetings. 
Donna told the OIG that she wrote on the back of the photographs what John 
told her about the photographs, which included that “Khalid Al-Midar” 
traveled from Sana, Yemen, via Dubai, to Kuala Lumpur on January 5, 2000, 
and he was in Kuala Lumpur between January 6 and 8. She also wrote Khalid 
Mihdhar’s name on the back of the photograph in which he had been identified. 


According to Donna, neither John nor Peter discussed with her the fact 
that Khallad had been identified in these photographs. Donna told the OIG that 
she believes she would have noted being told that Khallad was in the 
photographs because she was interested in identifying Khallad and because it 
would have meant that the photographs had a definite connection to the Cole 
investigation. Donna also said that no one told her that Mihdhar had a U.S. 
visa or that Hazmi had traveled to the United States. 


John told the OIG that he did not recall anything about his discussion 
with Donna when he printed the Kuala Lumpur photographs for her. John said 
he recalled that at the time the FBI was trying to “nail down Quso’s story.” 

He said that he did not recall ever discussing the Khallad identification from 
the Kuala Lumpur photographs with Donna or anyone else at the FBI. 
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John emphasized that the FBI was focused on the Cole investigation, not 
the Malaysia meetings. He stated that while he had begun to theorize that 
Khallad had been in Malaysia, it was only “speculative” and he had not 
confirmed any of the information about a source identifying Khallad in the 
Kuala Lumpur photographs. Therefore, according to John, he would not have 
discussed the identification of Khallad with Donna. John emphasized that a 
significant impetus for the CIA’s interest in Khallad’s activities revolved 
around concerns that Khallad was planning a future terrorist operation in 
Malaysia. 


Peter told the OIG that he recalled talking to FBI IOSs, including Donna, 
about mapping the telephone number information based on information 
provided by Quso. But he said that he did not recall discussions with Donna 
about the Kuala Lumpur photographs or the Khallad identification. 


3. June 11, 2001, meeting 


a. Planning for the meeting 


Around the same time that Donna was discussing Quso and the Cole 
investigation with Peter and John, she also was planning a meeting at the New 
York FBI Office to discuss the Cole investigation. The planned participants 
for the New York meeting included personnel from FBI Headquarters, the 
CIA’s CTC, and the New York FBI agents working on the Cole investigation. 
FBI documents show that Donna began organizing the meeting as early as 
May 24. 


There was no record of an agenda for the meeting, and no supervisors 
were involved in the preparation for this meeting or were consulted regarding 
what should be accomplished at the meeting. Donna told the OIG that she 
organized the meeting in an effort to consolidate information and determine 
what further action was warranted on the Cole investigation. She stated that 
the purpose of the meeting at the New York FBI Office was to address 
unresolved issues and produce additional leads or other activities focusing on 
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the Cole investigation. According to a May 24 e-mail by Donna, the meeting 
was “to discuss our direction, particularly as it relates to Nashiri.”*** 


Donna stated that she planned to take the Kuala Lumpur photographs 
with her to New York to find out whether the New York FBI Cole agents, who 
had met and debriefed Quso, could identify him in the photographs. She said 
that if Quso was in the photographs, the FBI would have reason to question 
Quso’s statement that he had not gone to Malaysia but had met Khallad in 
Bangkok instead. 


Sometime after obtaining the Kuala Lumpur photographs from John, 
Donna queried CTLink for the name Khalid al-Midhar [sic], which John had 
provided to her and which she had noted on the back of one of the 
photographs.” In CTLink she discovered the NSA information from late 1999 
and early 2000 referencing Mihdhar’s planned travel to Malaysia and 
Mihdhar’s association with a suspected terrorist facility in the Middle East 
linked to al Qaeda activities. She also queried ACS about Mihdhar but did 
not obtain any additional information about him. 


Mary, an FBI detailee to the Bin Laden Unit who worked as a CTC desk 
officer, also attended the June 11 meeting, as did Peter, the CTC analyst. 
According to Mary, Donna invited her to the meeting and told her the meeting 
was intended for information sharing and as a “brainstorming session” 
concerning the Cole investigation. Mary told the OIG she had recently been 
given the assignment by CTC management of “getting up to speed” in her 
spare time on the Malaysia meetings and determining any potential connections 
between the Malaysia meetings and the Cole attack. Mary said that she had not 
yet begun reviewing the Malaysia meetings at the time of Donna’s invitation. 


224 Abdul Rahim al-Nashiri was al Qaeda’s chief of operations in the Persian Gulf and 


was suspected to have been involved in the attack on the Cole. According to Donna, at the 
time he was believed to be the “on-scene commander” for the Cole attack, and the IOSs had 
been assigned the task of trying to locate him based on the intelligence reporting on him. He 
has since been arrested outside the United States. 


225 CTLink is a database administered by the CIA and used to disseminate information 


within the Intelligence Community. 


288 


According to Peter, the meeting was also described to him as an 
“information sharing and brainstorming session” to determine whether any 
further leads should be pursued. Peter said that he heard about the meeting 
from Mary and contacted Donna about attending because he was interested in 
learning what the New York FBI agents had uncovered in their investigation of 
the Cole attack. 


According to FBI personnel in New York, Donna told them that FBI 
Headquarters and CIA personnel had indicated they had “information to share” 
regarding the Cole investigation. The FBI New York personnel anticipated the 
meeting would be a mutual exchange of information. Scott, one of the New 
York case agents on the Cole investigation, said he was told that the CIA 
representatives who would be attending the meeting wanted a briefing on the 
Cole investigation. On his own initiative, Scott arranged for David Kelley, an 
AUSA from the SDNY who was assigned to the Cole matter, to discuss with 
the CIA representatives other issues related to the Cole investigation, one of 
which was the impact on the prosecution if some of the targets of the Cole 
investigation were captured or detained outside the United States. 


b. The June 11 meeting 


On June 11, the meeting was held in a conference room at the FBI’s New 
York Field Office. We could not determine with certainty all the participants 
at the meeting. There was no list of attendees, and the witnesses could not 
recall exactly who was there. However, we confirmed that Donna, Mary, 
Peter, Scott, and another New York agent assigned to the Cole investigation 
who we call “Randall,” attended. AUSA Kelley attended for part of the 
meeting. Although it was unclear exactly how long the meeting lasted, the 
witnesses said it lasted between two and four hours. 


In interviews with the OIG, the attendees said they did not recall the 
specifics of what was discussed at the meeting. The only contemporaneous 
notes from the meeting that we were able to obtain were Donna’s. Her notes 
indicate that the latest developments in the Cole investigation were discussed. 
The second page of the notes is labeled “to do” and referenced several items. 


Randall said he recalled that at the beginning of the meeting, Scott gave 
an update of the results and status of the investigation. Mary said she recalled 
that the attendees “brainstormed” various issues, but she did not recall any 
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significant ideas being developed during the meeting. Peter said he recalled 
that the New York agents “railed” about the U.S. Ambassador to Yemen and 
the lack of cooperation they believed they were receiving from the Yemeni 
government. At some point during the meeting, AUSA Kelley discussed the 
feasibility of prosecution in the Cole case. 


Toward the end of the meeting, Donna produced the three Kuala Lumpur 
surveillance photographs and asked the agents if they recognized Quso in any 
of the photographs. Donna said she told the agents that the photographs had 
been taken in Malaysia around the Millennium. Donna said she provided 
Khalid al Mihdhar’s name to at least some of the agents present. A New York 
agent tentatively identified one of the pictured individuals as Quso, but he 
could not make a definitive identification.**° The witnesses’ accounts of what 
happened next differ. 


Scott told the OIG that after reviewing the Kuala Lumpur photographs, 
the FBI agents began to ask questions, such as whether there were additional 
photographs or information concerning the background on the photographs, 
including questions about Mihdhar, who was in the photographs. According to 
Scott, he pressed Donna and Peter for details of the Malaysia meetings. Scott 
told the OIG he was interested in the fact that the photographs were from 
Malaysia because from the Quso’s debriefings he knew that Khallad had 
planned to meet Quso in Malaysia, and any information linking Khallad to 
Malaysia was “directly related” to the Cole investigation. 


Scott contended that Donna “refused” to provide any further information 
about the photographs or the Malaysia meetings due to “the wall.” Scott told 
the OIG that he previously had numerous conversations about the wall with 
Donna, which had been an issue between them. He stated that during this June 
11 meeting, he disputed that the wall was applicable to the information at hand 
because the photographs had not been obtained as the result of a FISA Court 
order, and he continued to press Donna for more information. Scott said the 
meeting degenerated into an argument about the wall. 


*°° Only a limited number of New York agents had actually met Quso. The others 


had only seen photographs of him. 
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In his initial OIG interview, Scott described the meeting as very 
contentious and combative.” In a second OIG interview, although Scott did 
not characterize the meeting as having the same level of combativeness, he 
contended that he pressed Donna for more information but none was 
forthcoming. Scott stated he had heated telephone conversations and e-mail 
exchanges with Donna over this issue after the June 11 meeting. 


Donna, Mary, and Peter described the showing of the Kuala Lumpur 
photographs as a sidebar to the main meeting and generally inconsequential. 
All three asserted that neither the display of the surveillance photographs nor 
the meeting overall was contentious. Although Donna agreed that the FBI 
agents asked further questions regarding the origin of the photographs and 
asked for additional information regarding the Malaysia meetings, she 
contended that she responded simply by saying she did not know anything 
further. She told the OIG that these questions made sense to her when they 
were asked, but she did not know the answers. She stated that someone asked 
what kind of passport Mihdhar was traveling on, and Peter responded that it 
was a Saudi passport.*** According to Donna, she had not known this 
information prior to Peter stating it. Donna told us that this was the only 
information volunteered by Peter, and she believed he would have provided 
additional information if he knew it. 


Peter told the OIG that he was not asked any questions at the June 11 
meeting, he had no formal role, and he did not brief anyone on anything at the 
June 11 meeting. Peter explained that it is not within his purview or authority 
as an analyst to share CIA information. He said he did not recall the meeting 
becoming heated or contentious. He said he did not recall any time during the 


227 When we asked Scott whether an intelligence-designated agent could have been 


provided the information outside the presence of the criminal agents, Scott agreed that could 
have been done, but he did not think of it at the time and no one else suggested it. During 
his subsequent testimony before the Joint Intelligence Committee, however, Scott said that 
the wall must not have been at issue because the criminal agents could have just left the 
room and any information could have been related to an intelligence agent. 


*°8 Donna’s contemporaneous notes reflect this information. It appears as the last entry 


on the notes, indicating that this was discussed at the end of the meeting. 
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meeting where Donna said, “I can’t answer that question” or directly refused to 
answer a question.*” 


Mary stated that she had not been “up to speed” on the case at this time, 
so she was not in a position to provide information at the meeting. She stated 
that she and Peter were not asked any questions during the meeting. She said 
that she did not recall any serious disagreements arising during the meeting. 


According to Donna, she remained in New York after the meeting, 
without Peter and Mary, and she continued the discussions with the New York 
agents regarding the photographs after the meeting. She said that these 
subsequent conversations became fairly “heated,” as the agents pressed her 
with questions such as whether there were additional photographs and any 
documentation about the photographs.” 


Donna told the OIG she had provided to the agents all the information 
she had received from the CIA regarding the photographs. She told us that all 
she knew was that these three photographs were taken in Malaysia around the 
Millennium, and one of the persons in the photographs was someone named 
Khalid al Mihdhar. Donna stated she advised the agents of this and told them 
that efforts would be made to obtain the requested information. She said she 
was not aware that there would have been additional information to provide. 
She added that she recalled having the impression that the agents did not 
believe her when she said that she did not have the information about the 
photographs that the agents were requesting. 


As discussed earlier, however, Donna had additional NSA information 
about Mihdhar that she had discovered through her CTLink query. The 
information related to the planned travel to Malaysia of several members of an 
“operational cadre” and Mihdhar’s association with a suspected terrorist 
facility in the Middle East linked to al Qaeda activities. Donna told us that she 


22 As described earlier, Peter and John had exchanged several e-mails about the 


Malaysia meetings and the photographs. However, it is unclear based upon the information 
available to us exactly what Peter knew at this point. He said he was unable to remember 
exactly what additional information he had on June 11, 2001. 


230 We believe it likely that the agents were confusing the post-meeting discussions with 


the showing of the photographs at the meeting. 
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could not provide this information directly to the agents working the Cole 
criminal investigation due to the caveat, which prevented all NSA 
counterterrorism-related intelligence information from being provided to FBI 
criminal agents without approval from the NSA.” 


Donna told us that the New York FBI primarily worked criminal 
terrorism investigations and the sharing of intelligence information with the 
criminal agents was often an issue. She said that some of the New York agents 
had become “overly sensitive” about a perceived lack of information sharing. 
Donna emphasized that any information could be shared but often a process 
had to be followed before certain intelligence information could be shared with 
agents working criminal investigations. She added that it was not her job to 
keep information from the agents but instead to ensure they had the tools 
necessary to do their job. 


According to Donna, the only issue regarding the Kuala Lumpur 
photographs would have been obtaining permission from the CIA to allow 
individuals outside of the FBI to see the photographs in furtherance of the Cole 
investigation, such as in interviews conducted in Yemen.*” Donna said at 
some point while she was in New York, she and the agents discussed providing 
the photographs to the agents working in Yemen in order to get a positive 
identification of Quso in the photographs and to conduct further 
investigation.” She stated that she told the agents that she would attempt to 
obtain the requisite permission to provide the photographs to the agents 
working the Cole investigation in Yemen. 


231 Tt is important to note, however, that this NSA information originally had been 


routed not only to FBI Headquarters but also to the New York FBI Office in late 1999 and 
early 2000. 


232 A policy in the Intelligence Community, which is designed to protect intelligence 


sources and methods, is that the originator of intelligence information controls the further 
dissemination of the information. This policy is described as originator controlled, or 
“ORCON.” Dissemination of ORCON information requires permission from the originating 
agency to further disseminate the information outside the receiving agency. 


233 Apparently unbeknownst to the involved FBI and CIA personnel, the Yemeni 


authorities already had been given the photographs on January 3, 2001, six months before 
anyone at the FBI received the photographs. 
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Although she had no explicit discussion with John regarding the use of 
the photographs, Donna stated she understood that the photographs were “not 
formally passed” to the FBI when John gave them to her, but only provided for 
limited use in the meeting. Therefore, Donna said she did not believe that she 
could leave the photographs with the New York agents until the requisite 
permission to show the photographs outside of the FBI had been obtained. 


However, John told the OIG that that since the photographs had been 
given to Donna, an FBI employee, they could be further distributed within the 
FBI. John agreed that the photographs could not be used by the FBI in any 
manner where they would be disclosed to a foreign government. For example, 
he said that without approval from the CIA, the FBI agents could not keep the 
photographs and show them to Quso, who was in Yemeni custody, because 
Yemeni officials also would see the photographs. 


c. Follow-up after the June 11 meeting 


We looked for evidence as to whether Donna or the New York agents 
conducted any follow-up efforts about the Kuala Lumpur photographs or 
obtaining permission from the NSA to pass the intelligence information to the 
New York agents. Donna said that she “probably” had follow-up 
conversations with John, Peter, and Mary about the photographs, but she did 
not specifically recall the conversations or obtaining additional information. 
Mary told the OIG that she recalled conversations with Donna about obtaining 
permission for the FBI to use the photographs of the Malaysia meetings in their 
investigation. 


Donna stated she was not contacted by Scott after the meeting, although 
she was working with another agent on the squad, who we call “Glenn,” in 
connection with tracking telephone toll records. Those records related to the 
Cole participants, the travel of Quso to Bangkok, and Quso’s potential travel to 
Malaysia. 


According to Scott, over the course of the summer, he had several more 
conversations with FBI Headquarters asking about any additional information 
on the Kuala Lumpur photographs, but he was not provided any additional 
information. He stated that he did not seek assistance from any supervisor in 
obtaining additional information. He told us that he and the rest of the New 
York Field Office had been fighting a battle with FBI Headquarters over 
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information sharing for months, and he was “dumbfounded” that he could not 
obtain the information about the Kuala Lumpur photographs. He stated that in 
hindsight he probably should have sought the intervention of a supervisor. 


Documentary evidence shows that, as a result of the June 11 meeting, 
Donna and the New York agents discussed the Kuala Lumpur photographs in 
several follow-up conversations. In an e-mail dated August 22 from Donna to 
Glenn, she wrote that there were additional photographs of the Malaysia 
meetings and that the reason that Mihdhar was of interest at the time was 
because of some threat information that led to the CIA looking at all persons 
named “Khalid.” In addition, she wrote that she had received assurances that 
the FBI would be able to use the Kuala Lumpur photographs outside the FBI. 
We discuss this e-mail in further detail in the next section. 


Documents also show that on August 27 Donna requested permission 
from the NSA to provide the intelligence information about Mihdhar to the 
New York Cole criminal agents. However, this request came after the FBI had 
discovered on August 22 that Mihdhar might be in the United States and had 
opened an investigation to determine whether he was in the country. We 
discuss the events that led to that investigation and the investigative efforts of 
the FBI in the next section of the report. 


4. OIG conclusions on May and June discussions 


While there were several interactions between FBI and CIA personnel in 
May and June 2001 that could have resulted in the FBI learning more about the 
Kuala Lumpur photographs and Mihdhar, the FBI personnel did not become 
aware of significant intelligence information about Mihdhar and Mihdhar’s 
connections to Khallad. The fact that Mihdhar had possessed a United States 
visa was not disclosed at this time by the CIA to Donna or the FBI. The fact 
that Hazmi had been at the Malaysia meeting and then traveled to Los Angeles 
also was not disclosed by the CIA. In addition, the fact that the source had 
identified Khallad, the purported mastermind of the Cole bombing, from the 
Kuala Lumpur surveillance photographs was not disclosed during these 
interactions. 


Although Donna knew about the Kuala Lumpur surveillance 
photographs, we do not believe that she was informed that Mihdhar had a U.S. 
visa or that Khallad had been identified in the photographs. Donna’s 
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contemporaneous notes on the back of the Kuala Lumpur photographs reflect 
the limited information that she had obtained about the photographs and the 
Malaysia meetings. The notes do not mention anything about Mihdhar’s 
possession of a U.S. visa. In addition, Donna stated that she was aware of the 
significance of Khallad to the Cole investigation, but the notes on the 
photographs also do not mention Khallad. Moreover, John, who provided the 
photographs to Donna, told the OIG he did not recall discussing the Kuala 
Lumpur photographs with her, and he did not believe that he would have 
discussed with Donna that Khallad had been identified in the photographs, 
because at the time he was not sure that this was true and he thought the 
information was “speculative.” Although an e-mail message indicated that 
Peter was planning to discuss the Khallad identification with Donna in a 
meeting on May 29, we were unable to determine that this meeting actually 
occurred. 


It was impossible for us to determine exactly what happened at the 
June 11 meeting with respect to the Kuala Lumpur photographs because the 
witnesses cannot recall the specifics of the discussions and there is little 
documentary evidence. It is clear, however, that the information regarding 
Mihdhar’s U.S. visa and the fact that Khallad had been identified in the Kuala 
Lumpur photographs was not discussed at the June 11 meeting. 


Donna told the agents about the photographs and provided them limited 
information that she had obtained from the CIA about the photographs. Most 
of the questioning about the photographs took place after the meeting, when 
Peter and Mary had left. We believe those interactions after the meeting 
became very contentious, with the New York FBI wanting more information. 
Donna did not provide the New York agents with the NSA intelligence 
information about the Mihdhar’s association with a suspected terrorist facility 
in the Middle East linked with al Qaeda activities, which she obtained through 
her research. She said she did not because of the restrictions placed on sharing 
such NSA information. As we discuss further in the next section, Donna 
subsequently contacted the NSA in reference to having the NSA information 
passed to the agents, but this did not occur until much later, on August 27, 
2001. 


We found little attempt by either the FBI agents or Donna after June 11 
to follow up on the information about the photographs that was discussed at the 
meeting. There is little evidence of follow-up until some time in August 2001, 
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when, as we discuss in the next section, the FBI learned that Mihdhar had 
recently entered the United States, and the FBI opened an investigation to 
locate him. 


The interaction between the CIA and the FBI in May and June 2001 was 
another failed opportunity for the FBI to obtain the critical information about 
Mihdhar and Khallad. The failure of the FBI to learn about Mihdhar, his 
connection to Khallad, and his travel to the United States at that time 
demonstrated significant problems in the flow of information between the CIA 
and the FBI. We discuss these deficiencies in the analysis section of this 
chapter. 


E. The FBI’s efforts to locate Mihdhar in August and September 
2001 


The fifth and final opportunity for the FBI to locate Mihdhar and Hazmi 
occurred in late August 2001, when it was informed that Mihdhar and Hazmi 
had traveled to the United States. The FBI learned in August 2001 that 
Mihdhar had entered the United States in July 2001 and that Mihdhar and 
Hazmi had previously traveled together to the United States in January 2000. 
On August 29, the FBI began an investigation to locate Mihdhar, but it did not 
assign great urgency or priority to the investigation. The New York FBI 
criminal agents who wanted to participate in the investigation were specifically 
prohibited from doing so because of concerns about the wall and the 
procedures to keep criminal and intelligence investigations separate. The FBI 
did not locate Mihdhar before the September 11 attacks. 


We review the facts surrounding the FBI’s discovery of this information 
about Mihdhar and Hazmi and what the FBI did with this information in 
August. We also examine the FBI’s unsuccessful efforts to locate Mihdhar 
before the September 11 attacks. 


1. Continuing review of the Malaysia meetings in July and 
August 2001 


As discussed above, John, the CIA Bin Laden Unit Deputy Chief, was 
detailed to the FBI’s ITOS in May 2001. Shortly before assuming his duties at 
the FBI, John had asked CTC management to assign a CTC desk officer with 
“getting up to speed” on the Malaysia meetings and determining any potential 
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connections between the Malaysia meetings and the Cole attack. This 
assignment was given to Mary. She told the OIG that “getting up to speed” 
meant she would have to research and read the pertinent cable traffic as her 
schedule permitted. She emphasized that her priority assignment during this 
period was the credible threats of an imminent attack on U.S. personnel in 
Yemen, and she said that she worked the Malaysia meetings connections to the 
Cole attack whenever she had an opportunity. 


In early July 2001, based on recent intelligence information, the CIA had 
concerns about the possibility of a terrorist attack in Southeast Asia. On July 5, 
2001, John sent an e-mail to managers at the CTC’s Bin Laden Unit noting 
“how bad things look in Malaysia.” He wrote that there was a potential 
connection between the recent threat information and information developed 
about the Malaysia meetings in January 2000. In addition, he noted that in 
January 2000 when Mihdhar was traveling to Malaysia, key figures in the 
failed attack against the U.S.S. The Sullivans and the subsequent successful 
attack against the U.S.S. Cole also were attempting to meet in Malaysia, and 
that one or more of these persons could have been in Malaysia at that time. 
Therefore, he recommended that the Cole and Malaysia meetings be re- 
examined for potential connections to the current threat information involving 
Malaysia. He wrote, “I know your resources are strained, but if we can prevent 
something in SE Asia, this would seem to be a productive place to start.” He 
ended the e-mail by stating that “all the indicators are of a massively bad 
infrastructure being readily completed with just one purpose in mind.” 


On July 13, John wrote another e-mail to CTC managers stating that he 
had discovered the CIA cable relating to the source’s identification of 
“Khallad” from the Kuala Lumpur surveillance photographs in early January 
2001. John began the e-mail by announcing “OK. This is important.” He then 
described Khallad as a “major league killer who orchestrated the Cole attack 
and possibly the Africa bombings.” The e-mail recommended revisiting the 
Malaysia meetings, especially in relation to any potential information on 
Khallad. Significantly, John ended the e-mail asking, “can this [information] 
be sent via CIR to [the FBI]?” 


Despite John’s recommendation that this information be forwarded to the 
FBI in a CIR, we found no evidence indicating that the CIA provided this 
information to the FBI until August 30, 2001, which, as we describe below, 
was after the FBI learned about Mihdhar’s presence in the United States. 
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In a response e-mail dated July 13, 2001, a CTC Bin Laden Unit 
supervisor stated that Mary had been assigned to handle the request for 
additional information on the Malaysia meetings. In addition, the e-mail stated 
that another FBI detailee to the CTC, Dwight, who was out of the office at the 
time, would be assigned to assist Mary upon his return. 


Later in July, Mary drafted a cable to another CIA office requesting 
follow-up information about the Malaysia meetings. The cable included a 
reference to the source’s identification of Khallad in one of the Kuala Lumpur 
photographs and that Khallad and Mihdhar had been in Malaysia at the same 
time, possibly together. A week later, the CTC supervisor forwarded the cable 
to John for his review prior to release, and the cable was sent to the office to 
which it was addressed three days after that. 


On the same day she drafted the cable referencing the source’s 
identification of Khallad, Mary located one of the CIA cables referencing 
Mihdhar’s possession of a U.S. visa. On the same date, Mary also reviewed 
the CIA cable that stated this visa information had been passed to the FBI in 
January 2000.*** 


In early August, Mary and Donna continued to discuss the Kuala Lumpur 
photographs. In an e-mail on August 7 from Donna to Mary, Donna requested 
a copy of the flight manifest for Mihdhar’s January 2000 trip to Malaysia in 
order to determine whether Quso had traveled with Mihdhar. She also asked, 
“if we could get the pictures cleared to show Al-Quso.” *” She continued, “the 
reasoning behind this would be that first, we do not have a concensous [sic] 
that the individual with Midhar [sic] is in fact Al-Quso. . . [second] to 
determine if Al-Quso can identify Midher by an other [sic] name.” Donna then 
discussed her continuing efforts to track telephone number information 
developed in the investigation. At the close of the e-mail, Donna wrote, “I plan 
to write something up, but perhaps we should schedule another sit down to 
compare notes on both sides. Let me know.” 


234 As discussed above, we found no evidence that this information had, in fact, been 


provided to the FBI. 


235 Apparently the desk officer was unaware that clearance had been received and that 


the photographs had been shared with Yemeni officials. 
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In a response e-mail on the same date, Mary wrote, “okay, all sounds 
good.” Mary also wrote that she thought Donna had Mihdhar’s flight manifest 
because John had mentioned it, but Mary indicated she would find the 
manifest. She wrote, “I think we will be able to clear the pictures, they are for 
passage to Quso, right?” Mary also asked whether the FBI would be able to 
meet with Quso again. Mary ended the e-mail, “I think a sit down again would 
be great” and mentioned the potential logistics of arranging the meeting. 


In another e-mail exchange on August 7, Donna thanked Mary and 
advised her that the FBI would again have access to Quso. Donna continued 
by stating that the Kuala Lumpur photographs also would be passed to a 
foreign government because Quso was currently in its custody. She stated that 
John could call if he had any questions. Donna tentatively scheduled a meeting 
with Mary at FBI Headquarters on August 15, 2001. However, it appears that 
the meeting did not take place.*** 


2. Discovery of Mihdhar’s entry into the United States 


On August 21, Mary located the CIA cables referencing Hazmi’s travel 
to the United States on January 15, 2000.” Mary checked with a U.S. 
Customs Service representative to the CTC about Hazmi’s and Mihdhar’s 
travel. She discovered that Mihdhar had entered the United States on July 4, 
2001, and had not departed. In addition, she confirmed that Hazmi had 
traveled to the United States in January 2000. 


Mary immediately relayed to Donna in a voicemail message on 
August 21 that Mary had something important to discuss with her. Donna was 
on annual leave on August 21. Mary told the OIG she did not have an 


236 Mary told the OIG that she took a week of annual leave during August, which she 


thought was during that week, and she thought that the meeting therefore had not occurred. 
Although the e-mail references a meeting, Mary and Donna both told us that they had no 
recollection of any meeting on August 15 or any one prior to August 22. 


237 Mary was copied on an e-mail from John to Peter in mid-May, 2001, in which John 


discussed the travel of Mihdhar and others who appeared to be “couriers on a sort.” In this 
e-mail John stated, among other things, that “Nawaf” [Hazmi] had traveled with someone 
from Bangkok to Los Angeles to Hong Kong. Mary stated to the OIG that she received this 
e-mail before she was “up to speed” on the Malaysia meetings. 
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opportunity to focus on the Malaysia meetings until August, but upon 
discovering on August 21 that Hazmi had traveled to the United States “it [the 
importance of the information] all clicks for me.” 


On August 22, Mary met with Donna at FBI Headquarters and informed 
her of Mihdhar’s July 4 entry and Hazmi’s travel to the United States in March 
2000.*** Donna verified in INS indices Mihdhar’s recent entry. She also 
learned that both Mihdhar and Hazmi had entered the United States on January 
15, 2000, and that they were allegedly destined for the Sheraton Hotel in Los 
Angeles, California. The INS records showed Mihdhar had departed the 
United States from Los Angeles on June 10, 2000, on Lufthansa Airlines. No 
departure record could be located for Hazmi. An INS representative advised 
Donna that departure information often was not captured in INS indices.*” 
Therefore, she incorrectly surmised Hazmi had also departed on June 10, 
2000.4 


Further INS indices checks confirmed Mihdhar had re-entered the U.S. 
on July 4, 2001, at the JFK Airport in New York, allegedly destined for the 
“Marriott hotel” in New York City. By the terms of his entry, Mihdhar was 
authorized to remain in the United States until October 3, 2001. The INS had 
no record indicating Mihdhar had departed the United States as of August 22, 
2001. 


Mary and Donna met with John on August 22 in his office at FBI 
Headquarters to discuss their discovery that Mihdhar recently had entered the 
United States and there was no record of his departure. All of them said they 
could not recall the specifics of the conversation, but all agreed that they 


238 There is some discrepancy in witness statements on whether this meeting occurred 


on August 22 or August 23. Although it is unclear on which date this meeting occurred, we 
believe the meeting occurred on August 22, 2001. 


239 The problem of INS departure records not being complete or accurate is described in 


an August 2001 OIG report entitled “The Immigration and Naturalization Service’s 
Automated I-94 System.” 


*“ Investigation conducted after September 11 found that Hazmi had remained in the 


United States. 
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realized it was important to initiate an investigation to determine whether 
Mihdhar was still in the United States and locate him if he was. 


On August 22, 2001, Donna sent an e-mail to the New York FBI Special 
Agent who we call “Glenn.” He was one of the agents assigned to the Cole 
investigation. In the e-mail, Donna advised Glenn that she had obtained 
Mihdhar’s flight manifest. Donna also wrote, “the reason they [the intelligence 
community] were looking at Midhar [sic] is relatively general — basically they 
were looking at all individuals using the name Khalid because of some threat 
information.” Significantly, the e-mail also advised that the CIA had 
additional surveillance photographs beyond those she had taken to New York, 
and the source had identified one of the individuals in these additional 
photographs as Khallad. Donna said that she was “requesting the details on 
that [Khallad’s identification].” Donna also stated in her e-mail that the 
clearance to show the Kuala Lumpur surveillance photographs to Quso should 
not be a problem.*’ 


This e-mail was the first reference we identified that the FBI had been 
informed of additional Kuala Lumpur surveillance photographs in the CIA’s 
possession. It is also the first reference in any FBI document to the 
identification of Khallad in the Kuala Lumpur photographs. 


After her meeting with Donna on August 22, 2001, Mary asked another 
CTC officer to draft a CIR to the State Department, INS, U.S. Customs 
Service, and FBI requesting the placement of Mihdhar and his travel 
companions, Hazmi and Salah Saeed Muhammed bin Yousaf, on U.S. 
watchlists.” The CIR briefly outlined Mihdhar’s attendance at the Malaysia 
meetings and his subsequent travel to the U.S. in January 2000 and July 2001. 
On August 24, the State Department placed Mihdhar and his travel companions 


%1 Donna was unable to recall how she first discovered the information on the Khallad 


identification. We were unable to find any documents or other evidence clarifying this 
issue. 


242 At this time, several agencies maintained separate watchlists. The State Department 


watchlist was the VISA/VIPER system. Within VISA/VIPER, the TIPOFF system focused 
on suspected terrorists. The INS maintained the LOOKOUT system, which was also 
available to the Customs Service through TECS. 
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on its terrorism watchlist. This is the first record of the placement of Mihdhar 
or Hazmi on any U.S. watchlist. 


On August 23, 2001, Donna contacted the State Department and 
requested a copy of Mihdhar’s most recent visa application from the U.S. 
Consulate in Jeddah, Saudi Arabia. 


3. The FBI’s intelligence investigation on Mihdhar 


a. Steps to open the investigation 


On August 23, Donna contacted her supervisor, an SSA who we call 
“Rob,” regarding the information about Mihdhar’s travel to the United States. 
As discussed in Chapter Three, Rob was the acting Unit Chief of the UBLU at 
the time.” 


After reviewing the information, Rob concurred with Donna that the 
appropriate course of action would be to open an intelligence investigation in 
New York, Mihdhar’s last known destination in the United States, to locate 
Mihdchar. 


To expedite the investigative process and provide a “heads up [alert]” to 
the New York Field Office that the information was coming, on August 23 
Donna telephoned an agent on the Bin Laden squad in the New York Field 
Office who we call “Chad.” To comply with the wall, the New York Field 
Office had designated agents as either “criminal” or “intelligence,” and Chad 
was an intelligence agent. Donna discussed with Chad Mihdhar’s most recent 
entry into the United States and FBI Headquarters’ request for the New York 
office to open a full field intelligence investigation to locate Mihdhar. Donna 
told the OIG that she did not normally telephonically contact the field on these 
types of issues, but there was some urgency to her request because the FBI did 
not want to lose the opportunity to locate Mihdhar before he left the United 
States. She told us, however, that Mihdhar’s significance continued to be his 
potential connection to Khallad and the Cole attack — not that he was 
operational in the U.S. 


24 He was the acting Unit Chief of the UBL from June 28, 2001, until September 10, 
2001. 
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Chad told the OIG that although he routinely worked with Donna, this 
was the first time that Donna had relayed a need for urgency in an intelligence 
investigation. Chad told us, however, that he questioned both the urgency and 
the need for a separate intelligence investigation. Chad explained that the 
attempt to locate Mihdhar seemed to relate to the criminal investigation of the 
Cole attack, and efforts to locate an individual normally would be handled 
through a sub-file to the main investigation and not as a separate full field 
investigation. Nevertheless, he told Donna that New York would open an 
intelligence investigation. 


On August 23, Donna sent an e-mail to John concerning her telephone 
conversation with Chad. She advised in the e-mail that “[Chad] will open an 
intel[ligence] case.” In the e-mail she also discussed a connection that had 
been made between Mihdhar in Malaysia to another suspect in the Cole attack. 
She wrote, “I am still looking at intel, but I think we have more of a definitive 
connection to the Cole here than we thought.” She ended by stating that she 
was working on the EC requesting a full field investigation, but doubted that it 
would be completed that day. 


On August 27, Donna requested permission through the NSA 
representative to the FBI to pass to the FBI agents working on the Cole 
investigation the information associating Mihdhar with a suspected terrorist 
facility in the Middle East linked to al Qaeda activities. Donna told the OIG 
that she thought that the NSA information on Mihdhar could be useful to the 
Cole criminal investigators, even if the Mihdhar search remained an 
intelligence investigation. 


On the morning of August 28, Donna sent Chad a draft copy of an EC 
requesting the intelligence investigation to locate Mihdhar. In the cover e- 
mail, Donna stated, “here is a draft” and that the EC had not been uploaded due 
to some tear line information that was not yet approved for passage.” She 
concluded, “I do want to get this going as soon as possible.” 


The EC, entitled “Khalid M. Al-Mihdhar” with various aliases, stated in 
the synopsis, “Request to open an intelligence investigation.” The EC outlined 
Mihdhar’s travel to the United States in July 2001, his previous travel to the 


*“ According to the NSA, the request was approved later that same day. 
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United States with Hazmi in January 2000, the background on and his 
attendance at the Malaysia meetings, his association with a suspected terrorist 
facility in the Middle East linked to al Qaeda activities, and similarities 
between Mihdhar’s travel and that of Cole suspects Quso, Ibrahim Nibras, and 
Khallad. As to the identification of Khallad in the Kuala Lumpur photographs 
by the source, Donna told the OIG that she did not include this information 
because it had not yet been officially passed to the FBI, although she had 
requested the passage from a CTC Representative to the FBI.*” 


While Donna had relayed urgency to opening the investigation in her 
telephone conversation with Chad and in her cover e-mail, she designated the 
EC precedence as “routine,” the lowest precedence level.” She explained this 
by saying this case was “no bigger” than any other intelligence case. She also 
told us, however, that there was a time consideration because Mihdhar could be 
leaving the United States at any time and that is why she had personally 
contacted Chad. 


b. The FBI opens the intelligence investigation 


On August 28, Chad forwarded Donna’s draft EC to his immediate 
supervisor, a Supervisory Special Agent who we call “Jason.” Jason became a 
supervisor on the JTTF in the New York Field Office in 1996. He had been on 
the New York JTTF since 1985. 


At approximately 2:00 p.m. on August 28, Jason forwarded the EC to 
various agents on the Bin Laden squad, including the Cole criminal case agent 
who we call “Scott.” In the cover e-mail, Jason directed the Relief Supervisor, 
who we call “Jay,” to open an intelligence investigation and assign it toa 
Special Agent who we call “Richard.” Jason also directed another agent to 


**° This information officially was passed to the FBI in a CIR on August 30, 2001. 


246 As discussed in Chapter Three, ECs are marked with a precedence level based on an 


escalating scale beginning at “routine;” “priority,” connoting some urgency; and 
“immediate,” connoting the highest level of urgency. 
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check on an investigative lead related to Mihdhar while the agent was in 
Malaysia.” 


Scott received the EC on August 28. Scott, who had been at the June 11 
meeting and had discussions with Donna about the Kuala Lumpur photographs, 
contacted Donna to discuss the appropriateness of opening an intelligence 
investigation as opposed to a criminal investigation. Donna told the OIG that 
when she realized that the EC had been disseminated to Scott, she asked Scott 
to delete it because it contained NSA information and therefore required 
approval for review by criminal agents. Scott told the OIG that he deleted the 
EC as she requested. 


Shortly thereafter, Scott, Donna, and Rob engaged in a conference call to 
discuss whether the case should be opened as a criminal instead of an 
intelligence investigation. Scott told the OIG that he argued that the 
investigation should be opened as a criminal investigation due to the nexus to 
the Cole investigation and the greater investigative resources that could be 
brought to bear in a criminal investigation. Scott explained that more agents 
could be assigned to a criminal investigation due to the squad designations. He 
also asserted that criminal investigation tools, such as grand jury subpoenas, 
were far quicker and easier to obtain than the tools available in an intelligence 
investigation, such as a national security letter. 


Donna told the OIG that the information on Mihdhar was received 
through intelligence channels and, because of restrictions on using intelligence 
information, could not be provided directly to the criminal agents working the 
Cole investigation. The only information that could be provided directly to 
them was the limited INS information. She stated that without the intelligence 
information on Mihdhar, there would have been no potential nexus to the Cole 
investigation and no basis for a criminal investigation. Rob told the OIG he 
had concurred with Donna’s assessment that the matter should be an 
intelligence investigation. He added that there was also a process through 


*47 Jason told the OIG that he did not specifically recall this e-mail. He said he was out 


of the office the majority of the time from June until September 11, 2001, due to a serious 
medical condition, and he did not return to work full-time until September 11, 2001. 
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which the information could potentially be shared with the criminal agents in 
the future.” 


Scott was not satisfied with that response, and he asked for a legal 
opinion from the FBI’s National Security Law Unit (NSLU) whether the 
investigation should be opened as a criminal matter relating to the Cole 
criminal investigation. Additionally, Scott wanted a legal opinion on whether a 
criminal agent could accompany an intelligence agent to interview Mihdhar if 
he was located. 


According to Donna, she subsequently contacted the NSLU attorney who 
we call “Susan” on August 28, and she and Rob discussed the issue with Susan. 
It is unclear how she presented the matter to Susan because there were no 
documents about the conversation and she and Susan had little or no 
recollection of the specific conversation. Donna told the OIG that she provided 
the EC to Susan. According to Donna, Susan agreed with her that the matter 
should be opened as an intelligence investigation. Donna said Susan also 
advised that a criminal agent should not be present for an interview of Mihdhar 
if he was located. During an OIG interview, Susan said she could not 
specifically recall this matter or the advice she gave. Rob told the OIG that he 
did not recall the specifics of this consultation, but he stated that the NSLU 
opinion was supportive of FBI Headquarters’ determination that the case 
should be opened as an intelligence investigation. 


At approximately 7:30 a.m. on August 29, Donna sent an e-mail to Jason, 
which stated: 


I think I might have caused some unnecessary confusion. I sent 
the EC on Al-Midhar [sic] to [Chad] via email marking it as 
DRAFT so he could read it before he went on vacation. There is 
material in the EC...which is not cleared for criminal 
investigators. [Scott] called and [Rob] and I spoke with him 
and tried to explain why this case had to stay on the intel. side of 
the house...In order to be confident...for this case to be a 199, 


248 Rob told the OIG that the squad’s Supervisory Special Agent acted as “the wall” 
between intelligence and criminal investigations during this period, and Jason could 
subsequently open a criminal investigation if warranted. 
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and to answer some questions that [Scott] had, [Rob] and I 
spoke with the NSLU yesterday afternoon*”...The opinion is as 
follows: Al-Mihdar [sic] can be opened directly as a FFI [Full 
Field Investigation]...The EC is still not cleared for criminal 
investigators...Per NSLU, if Al-Mihdar [sic] is located the 
interview must be conducted by an intel agent. A criminal agent 
CAN NOT be present at the interview. This case, in its entirety, 
is based on intel. If...information is developed indicating the 
existence of a substantial federal crime, that information will be 
passed over the wall according to the proper procedures and 
turned over for follow-up criminal investigation.” 


Approximately 15 minutes after sending the e-mail to Jason, Donna sent 
an e-mail to Scott with the same language advising that the NSLU agreed the 
investigation should be an intelligence investigation and a criminal agent could 
not attend the interview if Mihdhar was located. That same morning, Scott 
responded in an e-mail to Donna stating: 


...where is the wall defined? Isn’t it dealing with FISA 
information? I think everyone is still confusing this 
issue...someday someone will die — and wall or not — the public 
will not understand why we were not more effective and 
throwing every resource we had at certain ‘problems.’ Let’s 
hope the National Security Law Unit will stand by their 
decisions then, especially since the biggest threat to us now, 
UBL, is getting the most ‘protection’. 


Later that morning, Donna replied in an e-mail: 


I don’t think you understand that we (FBIHQ) are all frustrated 
with this issue. I don’t know what to tell you. I don’t know 
how many other ways I can tell this to you. These are the rules. 


24 Rob told the OIG that he could not recall whether he had talked to anyone from the 


NSLU about this issue. 


250 Rob told the OIG that the New York Field Office technically could have ignored 
Headquarters’ recommendation and opened a criminal investigation. However as a practical 
matter, the field would not normally ignore Headquarters’ decision. 
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NSLU does not make them up and neither does UBLU. They 
are in the MIOG*” and ordered by the [FISA] Court and every 
office of the FBI is required to follow them including FBINY... 


4. The New York Field Office’s investigation 


On August 29, 2001, the FBI’s New York Field Office opened a full field 
intelligence investigation to locate Mihdhar. The investigation was assigned to 
a Special Agent who we call “Richard.” Richard was a relatively 
inexperienced agent, who had recently been transferred to the Bin Laden 
squad.” This was Richard’s first intelligence investigation. 


On August 29, Donna received Mihdhar’s visa application from the U.S. 
Consulate in Jeddah. The application indicated that Mihdhar planned to travel 
as a tourist to the United States on July 1, 2001, for a purported month long 
stay. On the application, Mihdhar falsely claimed that he had not previously 
applied for a U.S. non-immigrant visa or been in the United States.” 


On August 30, 2001, Donna sent an e-mail to Richard. After a paragraph 
introducing herself, Donna advised she was attaching Mihdhar’s visa 
application form, which included Mihdhar’s photograph, and that she would be 
faxing the remaining documents. Donna stated she would send a couple of 
pages from the Attorney General Guidelines “which apply to your case” and 
then she would mail the documents. 


Richard told the OIG that on August 30, he received a telephone call 
from Donna in reference to the investigation. He said that Donna said the goal 
of the intelligence investigation was to locate and identify Mihdhar for a 


251 The MIOG is the FBI operational manual - Manual of Investigative Operations and 


Guidelines. Donna asserted this reference actually related to the Attorney General’s FCI 
Guidelines that are contained in the MIOG. 


22 Richard began working in the New York Field Office after graduating from the FBI 


Academy in June 2000. After serving briefly on an applicant squad, a drug squad, and a 
surveillance squad, Richard was assigned to the UBL squad in July 2001. 


23 Donna said she did not notice this discrepancy. As we discuss below, neither did the 


New York FBI. 
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potential interview. According to Richard, Donna did not indicate the 
investigation was an emergency or identify any other exigent circumstance. 


On August 30, 2001, the CIA sent a CIR to the FBI outlining the 
identification of “Khallad” from one of the Kuala Lumpur surveillance 
photographs in January 2001 by the source. The first line of the text stated the 
information should be passed to Rob. The CIA cable stated the FBI should 
advise the CIA if the FBI did not have the Kuala Lumpur photographs so they 
may be provided. This is the first record documenting that the source’s 
identification of Khallad in the Kuala Lumpur photographs was provided by 
the CIA to the FBI. 


Richard told the OIG that he began to work on locating Mihdhar on 
September 4. He stated that he had received the assignment on Thursday, 
August 30, but he worked all weekend and Monday on another exigent 
investigative matter involving a Canadian hijacking. As a result, he said he did 
not have the opportunity to begin work on the Mihdhar investigation until 
Tuesday, September 4. 


On September 4, Richard completed a lookout request for the INS, 
identifying Mihdhar as a potential witness in a terrorist investigation. Due to 
his unfamiliarity with completing the lookout form, Richard contacted an INS 
Special Agent who was assigned to the FBI’s JTTF in New York. We call this 
Special Agent “Patrick.” The INS lookout form has a box indicating whether 
the individual was wanted for “security/terrorism” reasons. Richard did not 
check this box. He said that he thought Patrick told him to identify the subject 
on the form as a witness, not a potential terrorist, to prevent overzealous 
immigration officials from overreacting. By contrast, Patrick, who was 
assigned to the JTTF since September 1996, told us that he did not provide this 
advice to Richard and he always checked the security/terrorism box whenever 
he completed the lookout form for a potential witness in a terrorism 
investigation. 


However, Richard asked Patrick to review the lookout request form for 
completeness, and Patrick sent the form to INS Inspections for inclusion in the 
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INS lookout system, without making any changes.*” During his initial 
interview with the OIG, Richard asserted that he also asked Patrick to review 
and explain Mihdhar’s travel documents, including the INS indices printouts 
and the visa application. In a follow-up interview, Richard said he could not 
definitively recall whether he had actually provided the predicating materials to 
Patrick or whether he merely had Patrick review the INS lookout request form. 


Patrick told the OIG that he recalled this request because it was the first 
one from Richard and because of Mihdhar’s subsequent involvement in the 
September 11 attacks. Patrick stated that he had not reviewed the predicating 
materials, but had only checked the request form for completeness. He added 
that if he had been shown any of the predicating materials on Mihdhar’s travel, 
the review would only have been cursory. Patrick and Richard both 
acknowledged that they did not notice the false statements on Mihdhar’s visa 
application. 


Richard also contacted a U.S. Customs Service representative assigned to 
the JTTF and verified that a TECS lookout was in place for Mihdhar. Richard 
conducted other administrative tasks such as uploading the initial information 
about Mihdhar into ACS. 


On September 4, Richard requested a local criminal history check on 
Mihdhar through the New York City Police Department. Richard told the OIG 
that he initially focused on Mihdhar, since he was captioned as the subject of 
the investigation in the predicating EC. After reviewing the EC several times, 
Richard noted the connection to Hazmi, so he conducted the same record 
checks on Hazmi as he had on Mihdhar. On September 5, Richard requested 
an NCIC criminal history check, credit checks, and motor vehicle records be 
searched in reference to Mihdhar and Hazmi. 


On September 5, Richard and another JTTF agent contacted the loss 
prevention personnel for the New York area Marriott hotels, since Mihdhar had 
indicated when he entered the United States in July 2001 that his destination 


254 Patrick explained that agents often provided just the information and he completed 


the lookout form, but “new” agents often completed the form themselves. Patrick estimated 
he received approximately 10 lookout requests each month. 
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was the Marriott hotel in New York. Richard learned that Mihdhar had not 
registered as a guest at six New York City Marriotts. 


Richard stated he also conducted Choicepoint™ searches on Hazmi and 
Mihdhar.*” Richard said he recalled he had another JTTF officer assist him 
with the searches because he was not familiar with the system. Richard did not 
locate any records on either Hazmi or Mihdhar in Choicepoint™.*° Richard 
told the OIG that it was not uncommon not to find a record because of 
variations in spelling of names or other identifying information. 


Hazmi and Mihdhar had traveled to Los Angeles, California on January 
1, 2000, via United Airlines, and INS records indicated that they claimed to be 
destined for a “Sheraton hotel” in Los Angeles. Therefore, on September 10, 
2001, Richard drafted an investigative lead for the FBI Los Angeles Field 
Office. He asked that office to request a search of the Sheraton hotel records 
concerning any stays by Mihdhar and Hazmi in early 2000. He also requested 
that the Los Angeles office check United Airlines and Lufthansa Airlines 
records for any payment or other information concerning Mihdhar and Hazmi. 
However, the lead was not transmitted to Los Angeles until the next day, 
September 11, 2001. 


By the morning of September 11, when the American Airlines flight 77 
that Mihdhar and Hazmi hijacked and crashed into the Pentagon, Richard had 
not uncovered any information regarding Mihdhar’s or Hazmi’s location in the 
United States. 


5. OIG conclusions on the intelligence investigation 


Although FBI and CIA personnel had many discussions throughout July 
and August 2001 about the Cole attacks and the Malaysia meetings, the CIA 


255 Choicepoint™ is a commercial service that mines information such as names, 


addresses, phone numbers, and other identifying information from public sources (such as 
telephone directories, local taxing authorities, and court records), as well as purchase 
information from merchants or other companies. The information is then consolidated into a 
large database and is accessible to law enforcement and other subscribers for a fee. 


256 After September 11, however, the FBI located records on Hazmi in this commercial 


database. 
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did not provide and the FBI did not become aware of the significant 
intelligence information about Mihdhar’s U.S. visa, the Malaysian matter, and 
the identification of Khallad in the Kuala Lumpur photographs until August 22, 
2001. In May 2001, one detailee to the CTC was assigned to “get up to speed” 
on the Malaysian matter in her spare time but said she had been unable to focus 
on the matter until August 2001. On July 13, even after John had suggested in 
an e-mail to the CTC that the Khallad identification from the Kuala Lumpur 
photographs be passed to the FBI via CIR, this was not done for several weeks. 
The CIR was not sent to the FBI until August 30, after the FBI learned of 
Mihdhar’s presence in the United States. 


The CIA also did not provide to the FBI the information about Hazmi’s 
travel to the United States in January 2000 until August 22. Donna stated that 
she did not receive this information until August 22, and her actions upon 
receipt of the information clearly indicate that she understood the significance 
of this information when she received it. She took immediate steps to open an 
intelligence investigation when she learned of this information. 


On August 22, once the FBI was aware of the intelligence information 
about Mihdhar and that he was in the United States, the FBI took steps to open 
an intelligence investigation to locate him. Yet, the FBI did not pursue this as 
an urgent matter or assign many resources to it. It was given to a single, 
inexperienced agent without any particular priority. Moreover, the dispute 
within the FBI about whether to allow a criminal investigation to be opened 
again demonstrated the problems with the wall between criminal and 
intelligence investigations. The FBI was not close to locating Mihdhar or 
Hazmi when they participated in the terrorist attacks on September 11, 2001. 
In the analysis section of this chapter, we address in more detail the FBI’s 
decision to open the matter as an intelligence investigation instead of a criminal 
investigation, and the inadequacy of the FBI’s efforts to investigate Mihdhar in 
late August and early September 2001. 


F. Summary of the five opportunities for the FBI to learn about 
Mihdhar and Hazmi 


In summary, there were at least five opportunities for the FBI to have 
learned about Mihdhar and Hazmi, including their connection to the purported 
mastermind of the Cole attack and their presence in the United States, well 
before the September 11 attacks. First, in early 2000, the FBI received the 
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NSA information about Mihdhar’s planned travel to Malaysia. Although the 
CIA informed the FBI of the Malaysia meetings in January 2000, the existence 
of Mihdhar’s U.S. visa and the surveillance photographs was not disclosed to 
the FBI. FBI detailees at the CTC read the pertinent CIA cable traffic with this 
information and drafted a CIR to pass this information to the FBI. But the CIR 
was not released to the FBI, purportedly at the direction of a CIA supervisor, 
and the FBI did not learn of this critical information until August 2001. In 
addition, in March 2000 a CIA office discovered that Hazmi had traveled to the 
United States in January 2000, but no one from the CIA shared this information 
with the FBI. 


Second, in February 2000, Mihdhar and Hazmi moved to San Diego, 
where they were aided in finding a place to live by the former subject of an FBI 
preliminary inquiry. In May 2000, Hazmi and Mihdhar moved in with an FBI 
asset in San Diego, California. However, the FBI did not learn of this 
information until after the September 11 attacks. 


Third, in early January 2001, the CIA showed the Kuala Lumpur 
surveillance photographs to a joint CIA/FBI source, and the source stated that 
“Khallad” was in one of the photographs. This identification could have led 
the FBI to focus on who else was at the Malaysia meetings with Khallad, the 
purported mastermind of the Cole attacks, which could have led the FBI to 
identify and locate Mihdhar. However, we concluded that, despite the CIA’s 
assertions, the source’s identification of Khallad in these photographs was not 
known by the FBI. 


Fourth, in May and June 2001, due to concerns about possible terrorist 
activities, CIA employees were again examining the Kuala Lumpur 
photographs, Hazmi’s and Mihdhar’s travel (including Hazmi’s travel to Los 
Angeles), and the identification of Khallad in the Kuala Lumpur photographs. 
At the same time, these CIA employees were discussing with FBI employees 
the Cole investigation and the Kuala Lumpur photographs. Yet, despite these 
interactions between the two agencies on the telephone, in e-mails, and in a 
June 11 meeting in New York, the FBI never was informed of the critical 
intelligence information that Khallad was identified in the Kuala Lumpur 
photographs with Mihdhar, and that Hazmi had traveled to the United States. 
Again, this information could have led the FBI to initiate a search for Hazmi 
and Mihdhar earlier than it eventually did. 
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Fifth, in July 2001 a former Bin Laden Unit Deputy Chief who was 
working in ITOS in FBI Headquarters confirmed that Khallad had been 
identified in the Kuala Lumpur photographs and wrote in an e-mail to CTC 
managers that this information needed to be sent in a CIR to the FBI. 
However, this information was not sent in a CIR to the FBI until several weeks 
later. On August 22, an FBI employee detailed to the CTC notified the FBI 
that Mihdhar had entered the United States on July 4, 2001. The FBI began an 
intelligence investigation to locate Mihdhar and Hazmi. However, the FBI 
assigned few resources to the investigation and little urgency was given to the 
investigation. The FBI was not close to locating Mihdhar and Hazmi before 
they participated in the September 11 attacks. 


IV. OIG’s analysis of the FBI’s handling of the intelligence information 
concerning Hazmi and Mihdhar 


We found systemic and individual failings in the FBI’s handling of the 
Hazmi and Mihdhar matter. As a result of these failings, there were at least 
five opportunities for the FBI to connect information that could have led to an 
earlier investigation of Hazmi and Mihdhar and their activities in the United 
States. 


In this analysis section, we first discuss the systemic problems involving 
the breakdowns in the gathering or passing of information about Hazmi and 
Mihdhar between the FBI and CIA. We then turn to the problems in handling 
intelligence information within the FBI. Finally, we discuss the actions of 
individual FBI employees in handling information about Hazmi and Mihdhar 
information. 


In this section, we do not make recommendations regarding the actions of 
the CIA and its employees. We believe the CIA shares a significant 
responsibility for the breakdowns in the Hazmi and Mihdhar case, and that 
several of its employees did not provide the intelligence information to the FBI 
as they should have. We leave it to the CIA OIG, the entity with oversight 
jurisdiction over the CIA and its employees, to reach conclusions and make 
recommendations on the actions of the CIA and its employees. 
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A. Systemic impediments that hindered the sharing of information 
between the CIA and the FBI 


The most critical breakdown in the Hazmi and Mihdhar case was the 
failure of the FBI to learn from the CIA critical information about them; their 
travel to the United States; and their association with Khallad, the purported 
mastermind of the Cole attack. These breakdowns reflected serious problems 
in the process before the September 11 attacks for sharing information between 
the FBI and the CIA. 


The FBI failed to receive from the CIA three critical pieces of 
intelligence about Mihdhar and Hazmi in a timely manner: 


e Mihdhar’s possession of a valid, multiple-entry U.S. visa; 
e Hazmi’s travel to the United States; and 


e The identification of Khallad in a surveillance photograph of the 
Malaysia meetings attended by Hazmi and Mihdhar and other al Qaeda 
operatives in January 2000. 


The CIA became aware of these three pieces of intelligence in January 
2000, March 2000, and January 2001. Despite claims to the contrary, we 
found that none of this information was passed from the CIA to the FBI until 
August 2001. Although the CIA failed to timely pass this information to the 
FBI, there were several opportunities for the FBI to have obtained this 
information in other ways. But significant systemic problems, which we 
describe below, hindered the flow of information between the CIA and the FBI. 


1. Use of detailees 


One of the most significant opportunities for the FBI to have obtained the 
intelligence information relating to Hazmi and Mihdhar was through the FBI 
detailees at the CTC. As discussed above, the FBI detailees to the CTC had 
access to CIA cable traffic and could read the cables that discussed Mihdhar’s 
U.S. visa, the surveillance of the meetings of al Qaeda operatives in Malaysia, 
Hazmi’s subsequent travel to the United States, and the Khallad identification 
from the Kuala Lumpur photographs. Several of the FBI detailees accessed 
and read some of these cables. Significantly, in January 2000, one detailee, 
Dwight, prepared a draft CIR to pass to the FBI the information about 
Mihdhar’s visa, his al Qaeda connections, and his travel to Malaysia. The FBI 
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should have been informed of this information because of its clear domestic 
nexus. 


However, the CIR was never sent to the FBI. According to a note on the 
CIR, John, a Deputy Chief of the Bin Laden Unit, directed that the CIR be 
placed on hold, and FBI detailees did not have authority to disseminate CTC 
information without approval from the CIA. Eight days later, Dwight inquired 
about the disposition of the CIR through an e-mail to John asking whether 
anything needed to be changed on the cable. However, this e-mail failed to 
prompt further action on this CIR. The witnesses we interviewed had no 
recollection of the CIR and why it was not sent. We found no further record 
that anything was done with regard to the CIR. 


In our view, the CIA should have sent the CIR to the FBI because of the 
important information it contained, and the FBI detailee should have followed 
up to ensure that it was sent. While we found evidence that Dwight inquired 
about its status at least once, there is no evidence that he took any other action 
to ensure that the information was sent to the FBI, including inquiring with 
other CTC supervisors about the need to send the cable to the FBI. 


In reviewing the actions of the detailees, we found that the FBI lacked 
clear guidance on the role and responsibilities of FBI detailees to the CTC’s 
Bin Laden Unit. This led to inconsistent expectations about what they were 
supposed to be doing at the CTC. Our review of the documents and interviews 
with the five FBI detailees to the CTC’s Bin Laden Unit found that none of 
them had defined duties that were clearly understood, either by them or FBI 
managers. Nor were there any memoranda of understanding (MOU) between 
the FBI and the CIA setting out the job duties and responsibilities of any of the 
detailees.**” 


Moreover, we asked the FBI for the performance appraisals for all five of 
the detailees to the Bin Laden Unit during this period, and we received 


257 We asked both the FBI and the CIA for any memoranda of understanding between 


the agencies specifying the job duties of any of the detailees. The only MOUs we received, 
which were provided by the CIA, related to the administrative nature of the details, such as 
time and attendance reports, travel and training expenses, security clearances, and medical 
coverage. The MOUs did not address their substantive duties or responsibilities. 


317 


appraisals for three of them. They revealed that the FBI detailees were 
evaluated based on the elements for their positions at the FBI, not based on 
whatever they were supposed to be doing while working at the CTC.*® The 
FBI was unable to provide any other documents defining or outlining the roles 
or responsibilities of these detailees. 


We also interviewed the detailees about their understanding of their roles 
and responsibilities at the CTC. They stated that they were not given any 
specific instructions about their job duties. They described their details at the 
CTC as ill-defined and with little direction. As a result, each detailee defined 
the job at the CIA as he or she determined it to be, and there was significant 
variation in their conceptions of the job. 


For example, Dwight told the OIG that he focused on leads that were 
related to financial components of terrorism, which he developed from various 
sources, such as from reviewing cable traffic, from his supervisors at the CTC, 
and from referrals from CIA officers at the CTC. By contrast, Malcolm told 
the OIG that he thought he was the “eyes and ears” of the New York Field 
Office, and that his role was “to monitor” cases being worked jointly by the 
CIA and the New York Field Office, such as the East African embassy 
bombings investigation. He said that he also would follow up on requests for 
information from the FBI to the CIA. Moreover, Mary said she was not given 
any specific instructions about her role at the CIA, but she was eventually 
trained to be a CTC desk officer and that was how she operated — like other 
CTC desk officers with specific assignments or “accounts.” 


Eric, who was a Bin Laden Unit Deputy Chief, said that he was told “to 
fix” the relationship between the Bin Laden Unit and the FBI, but he was not 
given any specific instructions about how to go about accomplishing this 
objective. He said that he assisted in the running of the Bin Laden Unit by 
directly overseeing CTC operations and that he also functioned in a liaison role 
between the CIA and the FBI. He supervised the FBI detailees like he did 
other Bin Laden Unit employees. He was not given any other supervisory 


*°8 For a fourth detailee, Mary, the FBI produced only a performance plan but no 


appraisal reports. The performance plan was related to her duties as an FBI IOS. Mary told 
the OIG that she was directed by CTC management based on her work as a CIA desk officer 
and was not evaluated by FBI personnel. 
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oversight particular to the detailees. He said that on his own initiative he tried 
to stay abreast of matters that might be of interest to the FBI by reading the 
CTC cable traffic. However, he explained that determining what might be of 
interest to the FBI was very subjective because there were no criteria defining 
what should be brought to the attention of the FBI. 


We also interviewed the highest-ranking FBI employee detailed to the 
CTC, who was a Deputy Chief of the CTC from 1999 through 2002. We call 
him “Evan.” Evan believed that one of the FBI detailees’ functions would 
have been to review CIA cable traffic for information of potential relevance to 
the FBI. Yet, the detailees told the OIG that while reviewing CIA cable traffic 
was part of their jobs, it was not their function to review cable traffic for items 
of interest to the FBI, and they did not review all of the cable traffic on a daily 
basis. They said they did not think they were acting as backstops to ensure that 
anything that might be relevant to the FBI was brought to the FBI’s 
attention.*” The detailees asserted emphatically that their function did not 
entail scouring CIA cable traffic for the FBI, and their efficacy would be 
limited if they were perceived by CIA personnel merely as moles for the 
FBI.*” They also explained that even if this had been their role, it would have 
been difficult to do because of the volume of cables, especially during the 
chaotic Millennium period. 


The two FBI employees who held similar supervisory positions — one as 
a deputy chief in the Bin Laden Unit and the other as a deputy chief in another 
unit that later housed the Bin Laden Unit — also had differing views on their 
responsibility for reviewing cable traffic. Both agreed that their role was not 
merely to review cable traffic for items of interest to the FBI. Eric told the 


29 We also interviewed the first FBI employee detailed in March 1996 to Bin Laden 


Unit soon after it was created. This detailee was an agent from the FBI’s New York Field 
Office, and he remained at the CTC until August 1998. He said that he did not attempt to 
review all of the cable traffic. He indicated, however, that when he did locate information of 
interest to the FBI, he did not encounter problems obtaining the CIA’s permission to share 
this information with the FBI. 


260 Some CIA employees we interviewed stated that they, by contrast, believed that this 


was the function of the New York Field Office detailee. We discuss this further in the next 
section. 
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OIG that while he tried to review the traffic in order to stay abreast of the 
information in the CTC, it was too much for one person to manage effectively. 
By contrast, Craig, who followed Eric as a manager detailed to the CTC, told 
the OIG that he did not even attempt to review the cable traffic but only 
focused on those cables that required action on his part. 


In addition to failing to clearly define the roles and responsibilities of the 
detailees, the FBI did not provide oversight of the detailees. Eric acted as one 
of two deputy chiefs within the Bin Laden Unit. After Eric left the CTC, Craig 
was a deputy chief in a much larger unit that included the Bin Laden Unit. 
Both said that they performed day-to-day supervision of the detailees in the 
same manner in which they supervised the other CTC employees assigned to 
their groups.’ According to Eric and Craig, they did not focus specifically on 
the role of FBI detailees. 


Evan told the OIG that he did not supervise any of the detailees, and he 
had no authority to oversee their duties or direct their activities, except by 
virtue of his position as a senior manager within the FBI. He said that they 
were evaluated by their chain of command in the FBI office from which they 
had been assigned, which is supported by the limited documents we reviewed. 
We found that there was no oversight by the FBI of the detailees based on their 
function as detailees. 


The FBI’s failure to adequately oversee the detailees is illustrated by the 
role of Mary, the only FBI analyst detailed to the Bin Laden Unit. She has 
been detailed to the CIA since 1998. Mary had the opportunity to learn 
valuable analyst skills by working alongside CTC personnel and then use those 
skills at the FBI. Additionally, the detail provided an opportunity to learn 
about the CIA infrastructure and establish liaison contacts at the CIA. 


Mary told us that she operated as a full-fledged CIA desk officer, and that 
she has worked with FBI personnel during her detail but from the position of a 
CIA employee, not an FBI employee. We believe there needs to be a review of 
the duration of these details to ensure the value of these details is maximized. 


261 Eric left the CTC in mid-January 2000, and Craig did not arrive at the CTC until July 


2000. Thus, between mid-January and July 2000 the FBI had no supervisory presence for 
the FBI employees detailed to work Bin Laden matters at the CTC. 
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At a time when the FBI is concerned about the shortage of qualified analysts to 
do the work it has, a 5-year detail of an FBI analyst working as a CTC 
employee warrants review by the FBI.” 


The same lack of oversight and direction was evident regarding the work 
of Malcolm, the FBI New York Field office detailee to the CTC. He had been 
traveling to the CTC from New York on a weekly basis for four years, until 
January 2003. On Mondays he traveled from New York to the CTC, stopping 
by FBI Headquarters. On Fridays he stopped by FBI Headquarters on his way 
back to New York. After the bombing of the Cole, he spent at least half of his 
days in Washington, D.C. at FBI Headquarters. Thus, he was frequently away 
from the CTC and not in a position to maximize his potential for obtaining 
information at the CTC. This also left the perception with other CTC 
employees that he was not fully integrated into the CTC. 


We found that that the FBI lacked a systematic approach to its use of 
detailees at CTC’s Bin Laden Unit. The detailees could have functioned in one 
of three ways — as fully integrated members of the CTC working unilaterally 
on CTC matters, as backstops ensuring all pertinent CTC information was 
forwarded to the FBI, or in some combination thereof. While there are 
potential benefits to using the detailees in any of these functions, the potential 
benefits were not maximized because there was no clear understanding of the 
detailees’ roles and no system to ensure that any objectives were met. The lack 
of oversight over FBI detailees to the CTC resulted in squandering critical 
opportunities for information sharing between the CIA and FBI. 


We also found significant misunderstandings between employees of these 
two agencies regarding their respective responsibilities for information sharing. 
First, as noted above, we found that some CIA employees believed that FBI 
detailees had more responsibility for reviewing the CIA cable traffic than the 
FBI detailees believed that they had. One CIA Bin Laden Unit employee told 
the OIG that the CIA was not going to “spoon feed” information to the FBI and 
that the FBI personnel at the Bin Laden Unit had access to all of the CIA cable 
traffic. She stated that while the CTC provided to the FBI intelligence 


262 The OIG is in the process of completing a comprehensive review of FBI’s analyst 


program. 


321 


information that contained a domestic nexus, she did not believe it was the 
CIA’s responsibility to provide all of the predicating material, since the FBI 
detailees also had access to the same cables. In addition, CIA personnel 
described FBI detailee Malcolm as a “mole” for the FBI’s New York Office, 
suggesting they thought he was reading CIA cables for the express purpose of 
reporting back to the New York Field Office on what he found. 


In addition, we found that a similar misunderstanding existed among FBI 
employees in New York with respect to the role of the CIA employee detailed 
to the FBI’s New York Field Office. A CIA employee assigned to the JTTF in 
the New York Field Office had a desk in that office’s sensitive compartmented 
information facility (SCIF).** FBI agents in the New York Field Office 
asserted to the OIG that this individual was knowledgeable regarding their 
investigations and that he was responsible for reviewing CIA traffic, finding 
items of interest to the FBI, and bringing this information to the attention of 
appropriate New York agents. 


The CIA employee, however, denied that this was his role. He told the 
OIG that he had been sent to the New York Office to “improve the relationship 
between the CIA and the FBI” and that he provided the FBI with CIA 
intelligence that was designated for the FBI New York Field Office’s review. 
He stated, however, his job was not to “spoon feed” information but only to 
make it accessible to the agents in New York. This meant that he would print 
information obtained from CIA databases that was of potential interest to the 
FBI New York Field Office and make that information available for review in 
the SCIF if FBI agents decided to come and review it. But, apparently 
unknown to many New York FBI agents, he believed the onus was on FBI 
personnel to come into the SCIF and see if any new, relevant information had 
arrived, rather than to alert them to that information. He also said that while he 
generally knows what the various FBI squads are investigating, the New York 
JTTF has over 300 members and he could not reasonably be expected to have 
knowledge of all their investigative interests. He said that if he spent his time 


263 The FBI agents do not routinely work in a SCIF area. The computers on which they 


access ACS do not contain sensitive compartmented information or materials classified 
above Secret. Because a high percentage of CIA traffic contains this information, the CIA 
detailee must work in a separate area. 
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solely looking for information of interest to the FBI, he would never get any 
work done. 


As aresult, FBI agents in New York believed they were receiving from 
this CIA employee assigned to the JTTF all of the CIA information of interest 
to the FBI, when in fact they were not. Therefore, the New York agents could 
have received information on Hazmi and Mihdhar directly through their own 
CIA employee, but they misunderstood the process. 


2. FBI employees’ lack of understanding of CIA reporting 
process 


These gaps in the information sharing process were exacerbated by FBI 
personnel’s lack of understanding of the CIA’s reporting process. This 
problem is clearly illustrated by the failure of the FBI to obtain the information 
on the identification in January 2001 of Khallad in the Kuala Lumpur 
photographs by the joint FBI/CIA joint source. 


As detailed above, we concluded that the FBI’s ALAT was not made 
aware of the source’s identification of Khallad in the Malaysia meetings 
photographs. Although the ALAT attended the debriefing of the source, the 
ALAT did not immediately receive the information that the source had 
identified Khallad. We were unable to ascertain the reasons for this significant 
omission. However, our review found that there were later opportunities for 
the ALAT to have obtained information about the identification from CIA 
documents. In addition, we found that the New York FBI agents working the 
Cole attack investigation did not learn of this significant information, despite 
interviewing the source on several occasions. We believe this was due in part 
to the fact that the FBI personnel were not familiar with the CIA’s process for 
reporting intelligence information. 


As discussed previously, the CIA primarily relies on cable traffic to share 
intelligence among its personnel who are stationed around the world. None of 
these cables are available for FBI review, except by the limited number of FBI 
personnel with direct access to CIA computer systems, such as the detailees at 
the CTC. 


The CIA uses a certain type of cable called a TD to disseminate CIA 
information outside of the CIA to other U.S. government agencies. These 
cables are created by CIA reports officers based on their review of the internal 
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CIA cable traffic. The reports officers were described to us as “editors” who 
remove references to sources and methods contained in the cables and 
determine what information should be further disseminated in the TDs. Asa 
result, TDs did not necessarily include all the substantive information 
contained in the internal cable traffic. 


Our review found the ALAT did not understand that the TDs did not 
necessarily contain all of the intelligence gathered by the CIA from a particular 
source or on a particular event. The ALAT had been keenly aware of the 
significance of Khallad to the FBI, and contemporaneous FBI documents 
outline his efforts in mid-January 2001 to try to ensure that all the information 
obtained from the joint source was provided to the UBL Unit at FBI 
Headquarters and the Bin Laden Squad in the New York Field Office. 
However, he relied on the TDs concerning the source’s reporting to ensure the 
completeness of the information that he had provided to his FBI colleagues. 
The ALAT erroneously believed he had obtained all the source reporting 
through the TDs. This was not the case. The January 2001 Khallad 
identification was only reported in an internal CIA cable and was never 
included in a TD. 


In addition to the ALAT, New York FBI agents working on the Cole 
investigation told us that when they read a TD regarding a particular subject 
(which they could access through CTLink), they mistakenly believed that it 
contained all relevant information from the source debriefings. The primary 
Cole case agent told us that he believed that the CIA operational cables dealt 
with techniques and methods, but he did not know that these cables also 
contained the details of debriefings. He said that he had “assumed” all the 
substantive reporting would be contained in the TDs, so he never asked the 
CIA to allow him to review the underlying cable traffic. 


If these FBI employees had a more thorough knowledge of the 
information flow within the CIA, they could have ensured that they received all 
the relevant information from the joint source. This was especially significant 
in the case of Hazmi and Mihdhar because the CIA and FBI had decided the 
majority of the joint source’s reporting would be handled through CIA 
channels, and the ALAT did not independently report in FBI documents most 
of the source’s information. For example, in this case, the FBI could have 
requested to review the CIA’s internal cables or asked the interviewing CIA 
officer to review the TDs and the FBI documentation to ensure all the 
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information had been captured. However, the lack of understanding by FBI 
personnel of the CIA reporting process and its procedures for sharing 
intelligence contributed to the FBI not learning of significant information in 
CIA cables about Khallad — which would have tied an al Qaeda operative to the 
Malaysia meetings attended by Mihdhar and potentially resulted in the FBI 
focusing on Mihdhar much earlier. 


3. Inadequate procedures for documenting receipt of CIA 
information 


We also found that the FBI lacked consistent policies or procedures for 
the receipt and documentation of intelligence information received from the 
CIA. In addition, structural impediments within the FBI undermined the 
appropriate documentation of information received from the CIA. 


As we detailed above, the information concerning the surveillance of 
suspected al Qaeda operatives at the Malaysia meetings, including Mihdhar, 
was verbally conveyed in January 2000 by a CIA officer to two FBI employees 
who were working in the FBI’s Strategic Information Operations Center 
(SIOC). But this important information was not documented in any retrievable 
form at the FBI. 


The FBI was able to provide only three documents regarding the briefing 
on this information. First, one FBI e-mail message was recovered through a 
painstaking review of messages on an FBI server that the FBI searched in 
connection with a request from the JICI. Although this written record survived 
from that time, no analyst or agent would have had access to the information, 
learned of its existence, or been able to conduct the type of search that led to 
the discovery of this document. Second, information regarding the briefing 
was also located in one of the FBI Director’s daily briefing documents 
prepared in response to the Millennium threats. These briefing documents, 
however, were not electronically archived in a searchable database that 
analysts or agents in the field could access. Third, a brief handwritten note 
about the information he received from the CIA was contained in the personal 
daily calendar of one of the FBI employees briefed by the CIA officer in the 
SIOC. 


We found there were no clear procedures for documenting intelligence 
communicated by the CIA to the FBI in an informal manner, such as the verbal 
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briefings on Mihdhar in the SIOC. Although the SIOC had been activated 
during the Millennium for the express purpose of handling threat information 
from various sources, FBI personnel assigned to the SIOC during this period 
told us that there were no procedures for the receipt and handling of 
interagency information communicated informally unless it related to an 
ongoing FBI investigation. Although one witness suggested that some type of 
log might have existed to record incoming physical information, such as 
documents, the FBI found no such log. Moreover, FBI witnesses told us that 
the log would not have been used to document verbal briefings. Therefore, any 
documentation of information received informally would have been at the 
discretion of the recipient. 


We are not suggesting that every informal communication from the CIA 
to the FBI should be documented. We also recognize it is difficult to know the 
significance of any individual piece of information when it is received. Yet, 
we believe that the FBI should attempt to establish criteria or guidance for 
determining what information from informal briefings should be documented, 
and how it should be documented. The information received in the SIOC on 
Mihdhar was recorded only in a briefing provided to the Director and executive 
staff, which is not available to others throughout the FBI. Clearly, the authors 
of the Director’s daily briefing believed there was some import to this 
information. Because the Mihdhar information was never documented in an 
accessible format, only those individuals personally informed about the CIA’s 
information on the Malaysia meetings or those present for the Director’s 
briefings were made aware of the Mihdhar information. In effect, it was lost to 
everyone else because no analysts or field agents would be able to search for or 
locate this information. An effective analytical program requires that analysts 
have access to all available information, and that pertinent information is not 
contained solely in the personal memories of selected individuals. 


This was particularly significant because the information on Mihdhar 
initially did not appear to be important. But it subsequently became very 
significant. In the summer of 2001, FBI personnel eventually recognized the 
significance of the Malaysia meetings. At this time, the e-mail and the 
information from the Director’s briefing in January 2000 were not available to 
the FBI personnel. Without mechanisms to maintain information in which the 
significance is not immediately apparent, the FBI will not be able to fully 
connect and analyze disparate pieces of information for their significance. 
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In addition, even if the agents who received the information in the SIOC 
had wanted to document it in a form that was available throughout the FBI, the 
FBI lacks an information technology system capable of adequately handling 
this type of information. As discussed previously, the FBI’s primary electronic 
information storage system is the Automated Case Support (ACS) System. 
ACS is a case management system designed to capture information related to 
specific investigations and not for this type of general intelligence information. 
There was no FBI system that would allow this type of information to have 
been maintained so that it would be available for directed searches or other 
subsequent data mining. It is also important to note that ACS is not approved 
for storage of information classified above the Secret level and is not approved 
for storage of any sensitive compartmented information. Thus, it is not 
available for storage of the majority of the relevant Intelligence Community 
information, including the information on Hazmi and Mihdhar. 


In the absence of effective methods for recording and retrieving 
information obtained from other intelligence agencies, the benefits of increased 
information sharing among the agencies will remain of limited use. Based on 
the system in effect during this period, the value of the information was 
minimal, unless the information was relayed to an individual who could 
immediately use the information or the information related to an ongoing FBI 
investigation. When, as here, subsequent additional information increases the 
significance of the prior information, the absence of an effective information 
retrieval system effectively precludes any meaningful effort by the FBI to 
analyze the disparate pieces of information over time. 


In sum, despite the fact that some personnel at the FBI were aware in 
January 2000 that Mihdhar was possibly linked to al Qaeda operations and 
traveled to Malaysia to meet with other suspected al Qaeda operatives, this 
information was unavailable for further analysis or use once the SIOC closed 
down in late January or early February 2000. Because no one was assigned to 
document, follow up, or track the information on Mihdhar, the FBI’s 
opportunity to discover Mihdhar’s valid U.S. visa during this period and 
therefore try to locate him was lost. 


4. Lack of appropriate infrastructure in FBI field offices 


Information sharing with the FBI also was impeded by the inadequate 
facilities for the handling of intelligence information in the two field offices 
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most directly involved in the Hazmi/Mihdhar matter. Intelligence information 
from the CIA is often classified at a high level. As a result, safeguards must be 
taken in handling the information, while still allowing appropriate FBI 
employees the ability to access and use the information. Unfortunately, the 
FBI’s field offices generally lacked both the necessary physical infrastructure 
and information technology to readily use this type of information. Without 
the appropriate physical infrastructure, the FBI will not be able to handle 
sensitive information in an effective manner. 


To handle SCI classified material, employees must store and review such 
information in a SCIF. Access to the SCIF is limited to individuals with the 
appropriate clearance level and the need to know the information in the SCIF. 
Adequate security measures must be implemented to prevent unauthorized 
individuals from gaining access to the spaces containing such materials. The 
type of equipment that may be brought into the space is also strictly limited. 
For example, cellular telephones, two-way pagers, and other unsecured 
communication devices are prohibited. Telephones in SCIFs must be 
designated for secure transmissions. Computer networks also must be secured 
for transmission of information. 


During our review, we observed the workspaces in the FBI New York 
and San Diego Field Offices and found that they were not set up to adequately 
handle the type of information involved in the Hazmi and Mihdhar cases. 
These workspaces were not adequately secured to permit FBI personnel to 
handle CIA and NSA information at their own desks, even if they had been 
given the information. Nor were the SCIFs suitable to permit agents to 
regularly access or handle such information. In the New York Field Office, for 
example, the SCIF we were shown was extremely small. The CIA detailee to 
the JTTF worked in this SCIF, but there was little room for any other personnel 
to enter, let alone use it as a workspace. In the San Diego Field Office, a small 
SCIF was used as a secure communications center for the entire office. The 
San Diego office lacked a separate SCIF for the JTTF,™ including the CIA 


264 We were informed that a separate SCIF for the JTTF is under construction in the San 


Diego Field Office. However, this SCIF will only be large enough to accommodate three or 
four employees at any one time. 
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representative assigned to the task force. As a result, the San Diego agents 
were hampered in their ability to access CIA information. 


We also found that New York and San Diego FBI agents did not have 
sufficient access to secure telephones, known as Secure Telephone Unit third 
generation or STU III telephones. The limited STU III phones available had to 
be shared among numerous agents. Again, this made communications 
involving classified material within the FBI or with other members of the 
Intelligence Community more difficult. An entire squad comprising as many 
as 25 individuals shared one or two STU III phones. 


In addition, as noted above, the FBI agents did not have access to 
computer systems that could store much of the information received from the 
CIA. The computers at each agent’s desk in the New York and San Diego 
Field Offices only provided access to ACS. This system does not permit 
storage or access to any information classified above the Secret level or any 
information deemed sensitive compartmented information. Therefore, even if 
the FBI recipients of the CIA information regarding Hazmi and Mihdhar had 
wanted to document and store such information in a retrievable fashion, they 
could not have stored it on the system that FBI agents use. The FBI had no 
internal system in New York and San Diego that allowed them to use the type 
of information involved in the Hazmi and Mihdhar case. 


In addition, most FBI agents in the field did not have direct access to 
CTLink, the shared Intelligence Community database that did contain some of 
the information on Hazmi and Mihdhar, such as the NSA information. Field 
agents could not access, let alone conduct research, on this system. As a result, 
even if the New York and San Diego agents wanted to search for relevant 
information about Hazmi and Mihdhar, any sensitive or highly classified 
information obtained from the NSA and CIA could not be stored in the one 
system that they used. 


In contrast, we observed that the CIA’s workspaces permitted their 
employees to access highly classified information on computers in their 
personal workstations. Each CIA employee had their own secure computer on 
which they could receive and research highly classified material. They had 
several secure telephones that could be used to discuss Top Secret information 
with others. The difference in CIA and FBI workspaces was particularly stark 
in the FBI’s San Diego Field Office where, due to the lack of access to an 
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appropriate SCIF, the CIA employee co-located with the FBI’s San Diego 
Field Office could not access CIA systems. To access CIA systems, he had to 
travel to a domestic CIA station. 


5. OIG conclusion on impediments to information sharing 


In sum, significant and systemic problems that were evident in the FBI’s 
handling of the Hazmi and Mihdhar case inhibited information sharing between 
the FBI and CIA. The FBI failed to define the roles and responsibilities of the 
FBI detailees to the CTC’s Bin Laden Unit. The FBI failed to ensure effective 
oversight of the detailees at the CTC. The FBI and the CIA failed to develop a 
clear understanding of the function of detailees from each other’s agencies. 

The FBI failed to understand the CIA’s reporting process. The FBI lacked an 
adequate computer system and appropriate infrastructure for handling 
intelligence information not directly related to a specific investigation. 


Although these systemic problems affected the flow of information 
between the FBI and CIA, we do not believe they fully explain the FBI’s 
failure to obtain the critical information on Hazmi and Mihdhar. Employees at 
both the CIA and the FBI failed to provide or seek important information about 
Hazmi and Mihdhar, despite numerous interactions between them on issues 
related to Hazmi and Mihdhar from January 2000 through August 2001. We 
found these interactions were substantive and that much of the information 
about Mihdhar and Hazmi was exchanged through these ongoing efforts. 
Unfortunately, the critical pieces of information relating to Hazmi and Mihdhar 
did not become known to the FBI until shortly prior to September 11. Asa 
former CTC Bin Laden Unit Deputy Chief aptly summarized it to us, 
“information that should have been shared was not, repeatedly.” 


B. The actions of the San Diego FBI 


In addition to issues that affected information sharing between the FBI 
and the CIA, the FBI had other opportunities to find information about Hazmi 
and Mihdhar before the September 11 attacks. The time that Hazmi and 
Mihdhar spent in San Diego was an opportunity during which the FBI could 
have obtained information about them but did not. As discussed above, Hazmi 
and Mihdhar entered the United States in January 2000 and moved to San 
Diego in February 2000, where they resided unbeknownst to the FBI. While in 
San Diego, Hazmi and Mihdhar associated with Omar al-Bayoumi, a person 
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whom the FBI had previously investigated, and they also lived with an active, 
FBI informational asset. Yet, the FBI did not become aware of their presence 
in San Diego until after September 11, 2001. 


Because Bayoumi spent a significant amount of time with Hazmi and 
Mihdhar in early 2000, it is possible that — had a full field investigation of 
Bayoumi been open at the time — the FBI could have discovered Mihdhar and 
Hazmi’s presence in San Diego and also uncovered the CIA information about 
their attendance at the Malaysia meetings. Because Hazmi and Mihdhar lived 
with an FBI asset, it is also possible that if the FBI had documented their 
presence in San Diego, it would have provided additional investigative leads 
that could have aided the New York FBI in locating them in August 2001. We 
therefore evaluated the San Diego FBI’s investigation of Bayoumi and the 
decision to close its preliminary inquiry on him in June 1999. We also 
examined the San Diego FBI control agent’s decision not to obtain or 
document information from his information asset about Hazmi and Mihdhar, 
who were boarders in the asset’s house. 


In examining the San Diego Field Office’s handling of the Bayoumi 
investigation and the informational asset, we also found that, despite the fact 
that FBI Headquarters had established counterterrorism as a top priority of the 
FBI in 1998, the San Diego Field Office was continuing to pursue drug 
trafficking as its top priority in 2001. While the FBI made counterterrorism its 
top priority on paper, the FBI took few steps to ensure that field offices 
complied with this directive. We discuss this issue at the end of this section. 


1. The San Diego FBIs preliminary investigation of Bayoumi 


As discussed above, Bayoumi is a Saudi national who in January 2000 
had been living in the United States for approximately six years, was well-paid 
by a Saudi company that contracted with the Saudi government, and was 
involved in setting up mosques in the San Diego area. Hazmi and Mihdhar met 
Bayoumi in Los Angeles approximately two weeks after entering the United 
States in January 2000. A few days later they moved to San Diego, where 
Bayoumi assisted them in obtaining an apartment in the complex where he 
lived. They lived in this complex for four months. 


Bayoumi’s name had first surfaced at the FBI in 1995 in connection with 
other investigations. Bayoumi’s name resurfaced at the FBI on August 31, 
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1998, when his apartment manager contacted the FBI to report her suspicions 
regarding Bayoumi’s activities. The manager reported that she had been 
notified by the U.S. Postal Inspection Service in March 1998 that Bayoumi had 
been sent a “suspicious” package from the Middle East. According to the 
manager, the package had broken open and had a number of wires protruding 
from it. She reported further that the apartment complex maintenance man had 
noticed a number of wires protruding beneath the bathroom sink in Bayoumi’s 
master bedroom. She reported that there had been large meetings of men, who 
based upon their dress appeared to be Middle Eastern, gathering in Bayoumi’s 
apartment on weekend evenings. She also complained that several parking 
spots were being illegally used by the people gathering at Bayoumi’s 
apartment. 


On September 8, 1998, the San Diego FBI opened a preliminary inquiry 
on Bayoumi.*” The assigned agent checked FBI indices for further 
information regarding Bayoumi and conducted other investigative steps. 


The agent contacted the U.S. Postal Inspection Service in reference to the 
alleged “suspicious” package sent to Bayoumi. A postal inspector advised the 
FBI agent that “suspicious” did not necessarily mean “nefarious,” and the vast 
majority of suspicious packages were benign. The postal inspector reviewed 
the report relating to the Bayoumi package and told the agent that the package 
had been deemed “suspicious” because it had no customs papers or appropriate 
postage and originated in Saudi Arabia. According to the report, there was no 
record of any wires protruding from the package, Bayoumi had retrieved the 
package, and it was no longer called a “suspect parcel.” 


According to the FBI agent, the apartment manager agreed to record the 
license plate numbers of the meeting participants. However, the manager later 
advised the agent that meetings had dwindled to a few participants and then 
stopped all together. 


265 Tn accordance with the Attorney General’s Foreign Counterintelligence Guidelines, a 


preliminary inquiry could be opened when there was information or allegations indicating 
that an individual is or may have been an international terrorist or a recruitment target of an 
international terrorist organization. Preliminary inquiries were permitted to remain open for 
120 days and had to be closed unless the FBI obtained sufficient evidence to open a full field 
investigation. 
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The agent asked fellow FBI agents to ask their “logical sources” for 
information regarding Bayoumi. The sources related the following concerning 
Bayoumi: 


e Bayoumi was married with small children and had recently 
completed a master’s degree program and he was looking for a 
Ph. D. program, but his test scores were too low. He was 
approximately 30 years old and unemployed. 


e Bayoumi was a Saudi who regularly attended the ICSD (Islamic 
Center of San Diego). He was married with children and was 
working on a master’s or other advanced degree. 


e Bayoumi reportedly delivered $400,000 to the Islamic Kurdish 
community in El Cajon, California in order to build a mosque. 
Source opined Bayoumi “must be an agent of a foreign power or 
an agent of Saudi Arabia.” 


e Bayoumi was in the U.S. on a student visa but was applying for a 
green card. Bayoumi claimed to have a master’s degree and was 
working on a Ph. D. His father was sending him $3,000 a month 
for support while he was in school. 


The FBI agent also contacted the INS in reference to Bayoumi’s 
immigration status. An INS special agent advised that Bayoumi was in the 
U.S. on an F-1 student visa, but his work visa had expired. However, the INS 
reported that his visa could be renewed. 


The FBI agent received no further substantive information in response to 
various information checks. According to the agent, the only remaining option 
was to conduct an interview of Bayoumi. After her supervisor consulted with 
fellow FBI agents who were working on a large, sensitive counterterrorism 
investigation involving an alleged terrorist organization, the supervisor 
instructed the agent not to conduct the subject interview of Bayoumi.*” The 
agent told the OIG that she did not believe the decision was inappropriate 


266 The file indicates that the decision not to conduct an interview was due to an 


investigation that included a proposed proactive element. The FBI believed that the benefits 
of interviewing Bayoumi did not justify the risk to the proposed operation. 
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based on the potential effect of such an interview on the other sensitive 
investigation. 


On June 7, 1999, the FBI closed its preliminary inquiry on Bayoumi, and 
he was no longer actively under investigation by the FBI. 


The FBI case agent told the OIG that she had no concrete information 
linking Bayoumi to any terrorist activities. She stated that the allegations that 
gave rise to the preliminary investigation were not substantiated. With respect 
to the source reporting that Bayoumi had received large sums of money from 
overseas, the case agent explained it was not unusual for foreign students, 
especially from Saudi Arabia, to regularly receive money, even large sums of 
money. Therefore, the case agent did not consider this to be inherently 
suspicious. The agent’s squad supervisor at the time and other agents on the 
squad also told the OIG that it was not unusual or suspicious for Saudi students 
to have received large sums of money from Saudi Arabia. 


As Stated above, one source had provided unverified information that 
Bayoumi could potentially be a Saudi intelligence operative or source. 
According to the agent, Bayoumi was allegedly very involved and interested in 
Saudi affairs in San Diego, and this probably led to the suspicions about 
Bayoumi’s connection to the Saudi government. However, the agent told the 
OIG that Saudi Arabia was not listed as a threat country and the Saudis were 
considered allies of the United States. °” Therefore, Bayoumi’s potential 
involvement with the Saudi Arabian government would not have affected the 
FBI’s decision to close the preliminary inquiry. 


The squad supervisor at the time of our investigation, who had been an 
agent on the squad for several years, told the OIG that before September 11, 
the Saudi Arabian government was considered an ally of the United States and 
that a report of an individual being an agent of the Saudi government would not 
have been considered a priority. Other agents on the squad also said that a 
source reporting that an individual was an agent of the Saudi government 


267 Country threats are defined by the FBI as foreign governments or entities whose 


intelligence activities are so hostile, or of such concern, to the national security of the United 
States that counterintelligence or monitoring activities directed against such countries are 
warranted. 
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would not have been cause for concern because the Saudi government was 
considered an ally of the United States. 


In addition, the case agent explained that more intrusive investigative 
techniques could not be conducted because of the restrictions of the Attorney 
General FCI Guidelines in effect at the time. No meaningful surveillance 
could be conducted, no bank records or other financial records could be sought, 
and very little investigative activity beyond fully identifying the individual 
could be done. 


In sum, we do not believe that the FBI’s actions with regard to Bayoumi 
and its decision to close the preliminary inquiry were inappropriate. The agent 
conducted logical investigative steps that were permitted under the Attorney 
General Guidelines in effect at the time, such as checking FBI records for 
information, asking other intelligence agencies for information about the 
subject, and asking agents to query their sources about the subject, but the 
agent did not uncover any information to support the allegations. The 
Guidelines did not permit the case agent to engage in more intrusive 
investigative techniques, such as a clandestine search of Bayoumi’s property, 
obtaining his telephone or financial records, or secretly recording his 
conversations. 


Although the Attorney General Guidelines would have permitted a 
subject interview of Bayoumi prior to closing the preliminary inquiry, the 
decision not to conduct an interview appeared warranted, given its possible 
effect on an ongoing significant investigation. 


2. The FBIs handling of the informational asset 


As described above, in May 2000 Hazmi and Mihdhar began renting a 
room in the home of an FBI informational asset. An FBI San Diego Special 
Agent who we call “Stan” was the asset’s control agent since the asset was 
opened in 1994. The asset had provided the FBI with significant information 
over the years and was considered a reliable source. He was well known in the 
Muslim community. He often rented rooms in his house to Muslim men in the 
community who needed temporary housing. At the time that Hazmi and 
Mihdhar moved in with him, he had two other individuals renting rooms in his 
house. Mihdhar lived with the asset until June 10, 2000, when he left the 
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United States, and Hazmi remained as a boarder at the asset’s home until 
December 2000. 


According to Stan, the asset told Stan that two young Saudis who had 
recently come to the United States to visit and study had moved in as boarders. 
The asset described them as good Muslims who often went to the mosque and 
prayed. The asset provided Stan with their first names but little other 
identifying information. Stan did not obtain any additional information from 
the asset about the boarders, such as their last names, and he did not conduct 
any investigation of them. 


Had Stan pursued information about Hazmi and Mihdhar, he might have 
uncovered the CIA information about them. In addition, he might have created 
a record in FBI computer systems about Hazmi and Mihdhar’s presence in San 
Diego, which would have provided the FBI with additional information and 
avenues of investigation when it began to search for them in August 2001. For 
these reasons, we examined Stan’s actions with regard to the asset. 


In interviews with the JICI staff and in congressional testimony, Stan 
stated that the informational asset primarily provided information about the 
activities and identities of persons in the Muslim community in San Diego who 
were the subjects of FBI preliminary inquiries or full field investigations. °° 
Stan said that the asset volunteered some information about other individuals 
as well. He said he thought that the asset had good judgment about which 
individuals might pose a threat and that his reporting had been “consistent” 
over the years. We reviewed the asset’s file and noted the asset provided 
information on a regular basis on a variety of different individuals and topics. 
Although we could not evaluate the asset’s judgment from the file, we consider 
Stan’s description of the asset’s reporting to be apt. 


Stan also stated that he was aware that the asset had boarders in his house 
over the years, and the fact that two new boarders had moved in with the asset 
did not arouse suspicion. He noted that the asset volunteered that the two 
boarders were living with him soon after they moved in, but the asset provided 
the information about his boarders as part of a personal conversation and not 
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OIG. 


As noted above, Stan has retired from the FBI and declined to be interviewed by the 
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because the asset believed that it had any significance. Stan stated the 
information provided from the asset was that the two boarders were from Saudi 
Arabia, which, according to Stan, was not a country that the United States had 
placed on the list as a threat to national security. Stan said that the asset did not 
describe his boarders as suspicious or otherwise worthy of further scrutiny. He 
also asserted that he was prohibited from further pursuing the information 
about Hazmi and Mihdhar, including documenting the information that he had 
obtained, because of the Attorney General Guidelines in effect at the time. 


In examining Stan’s actions, we first considered whether the Attorney 
General’s FCI Guidelines were applicable to the situation involving Hazmi and 
Mihdhar. As suggested by Stan, the Attorney General’s FCI Guidelines were 
designed to ensure that the FBI opened preliminary inquiries and conducted 
investigations only if the required predicating information was present. 
Because there were no allegations or information provided to Stan that Hazmi 
and Mihdhar were terrorists or agents of a foreign power, we agree that Stan 
did not have sufficient information to open a preliminary inquiry and actively 
investigate Hazmi and Mihdhar. 


We also considered whether, at a minimum, Stan could have attempted to 
obtain additional information about people who were living with his 
informational asset, such as their full names, and whether he was required to 
document the information on Hazmi and Mihdhar that he had received from his 
asset. First, we reviewed FBI policies and procedures for handling assets. 
Those policies did not require Stan to obtain information from an informational 
asset about people living in the asset’s house or to conduct record checks to 
obtain this information. In addition, the policies do not appear to require Stan 
to have documented information received from the asset about anyone living 
with him, or to even document their full identities if he had obtained that 
information. 


We also interviewed several FBI agents who were on Stan’s 
counterterrorism squad and asked them whether it would have been their 
practice to seek additional information about boarders living with an 
informational asset and what, if anything, they would have done with this 
information. We found no consensus among them about whether information 
on boarders like Hazmi and Mihdhar who lived with an informational asset 
should have been obtained and documented. Some agents stated that they 
would have pursued more information about boarders living with an 
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informational asset, while others stated that they would not have. Some of the 
agents stated that they would have noted the fact of the informational asset 
having boarders in his file. Some agents stated that they would have 
documented the identities of the roommates in an EC that would have been 
uploaded to ACS. However, former San Diego Division Special Agent in 
Charge William Gore told the OIG that he “did not believe anything had been 
done wrong” in the handling of the informational asset and he did not fault 
Stan for not obtaining the information. 


While we recognize that no FBI policy addressed this issue and there was 
a lack of consensus on what should have been done in a situation like this, we 
believe that it would have been a better practice for Stan to have questioned the 
informational asset about his boarders and obtained their full identities. Stan 
was aware that Hazmi and Mihdhar were relative strangers to the informational 
asset, and that they were not friends, family, or long-time associates of the 
asset. Stan also was aware that the asset had no direct knowledge of Hazmi 
and Mihdhar’s backgrounds and could not vouch for their character. 
Moreover, the boarders in the asset’s home were in a position to put the asset 
and the information he supplied to the FBI in jeopardy. Therefore, prudence 
and operational security would suggest that information about persons living 
with the asset should have been sought, at least to the extent of learning and 
documenting their names, and perhaps running a records check on them. 


If Stan had asked more questions about the asset’s boarders, he also may 
have acquired enough information to pursue further inquiry. For example, the 
asset has stated after the September 11 attacks that Hazmi and Mihdhar did not 
make telephone calls from his house, and that in retrospect he found this 
behavior to be suspicious. The asset also stated after September 11 that he had 
told Hazmi to stay away from Bayoumi because of his alleged association with 
the Saudi government. Therefore, if Stan had asked the asset a few more 
questions about Hazmi and Mihdhar and acquired this kind of information, it 
may have led Stan to conduct further inquiries, particularly since Bayoumi had 
been the subject of an FBI investigation. 


Moreover, while no specific FBI policy required agents to obtain 
information about persons living in a house with an informational asset, FBI 
policies required control agents to continuously evaluate the credibility of their 
informational assets. Before informational assets are approved, they are 
required to undergo a background investigation to assess their suitability, 
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credibility, and “bona fides.”?® Certain minimum checks were required, such 
as a check of FBI indices, local criminal checks, and CIA traces. The policy 
provided that additional checks “may be deemed necessary,” such as querying 
other assets and running indices checks on immediate family members. In 
addition, FBI policy provided that an asset’s bona fides “should be continually 
addressed,” even after the initial assessment was completed. 


More specifically, the FBI field office is required to conduct a yearly 
evaluation of each informational asset and provide the evaluation report to FBI 
Headquarters. This report is required to contain, among other things, the FBI’s 
number of contacts with the informational asset during the reporting period, a 
summary of the most significant information furnished by the informational 
asset, the number of preliminary inquiries and full investigations that were 
opened based on information provided by the informational asset, and “steps 
that have been taken to establish asset bona fides since last evaluation.” 
Although Stan would not have been required to obtain additional information 
about his informational asset’s boarders to complete this report, the FBI’s 
policy of continually vetting the credibility of its assets permitted Stan to seek 
more information about Hazmi and Mihdhar and the other boarders from his 
asset and run indices checks on any persons living with his informational asset. 


We reviewed the informational asset’s file, Stan’s yearly evaluation of 
the asset, and Stan’s reporting on the bona fides checks conducted on the 
informational asset. Based on our review, we were concerned by the lack of 
information included in the file in support of the bona fides checks conducted 
by Stan each year. In each of the documents provided to FBI Headquarters 
about the informational asset that we reviewed, Stan wrote the following 
perfunctory paragraph: “Asset bona fides have been established through 
independently received reliable asset reporting, [redacted] and physical 
surveillance.” 


Stan maintained no predicating information in the file on these bona fides 
checks. The file did not disclose which checks or surveillance had been 


269 The FBI defines “bona fides” to mean that the asset or informational asset “is who 
he/she says he/she is;” that the asset “has the position or access the asset claims to have;” 
and that the asset “is not working for or reporting to a foreign intelligence service or 
international terrorist organization without the knowledge of the FBI.” 
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conducted, by whom, when, or the results. Without that material, the 
informational asset’s bona fides were merely verified through the attestation of 
Stan. It is possible that Stan conducted numerous indices checks and 
conducted an exhaustive bona fides check on the informational asset each year. 
It also is possible that he conducted minimal or no checks and merely attested 
to the informational asset’s credibility based on their personal history and 
relationship. Because we were unable to interview Stan, we could not 
determine which was more likely. 


However, no FBI policy described the level of detail to be contained in 
an asset file. We believe the policy should require an asset file to contain at 
least minimal information to allow a reviewer to independently verify that an 
adequate background check has been conducted. This information is necessary 
to allow FBI managers to determine whether the control agent is continuing to 
assess each informational asset’s credibility. This information would also help 
ensure that the control agent has not become too comfortable with the 
informational asset and thus vulnerable to being misled or failing to obtain 
adequate information about the asset. 


We also were concerned by the lack of policy or practice specifying what 
information from the asset must be documented. The Hazmi and Mihdhar case 
clearly demonstrates that information must be documented to be useful. Even 
if Stan had obtained the full names of Hazmi and Mihdhar from the 
informational asset, he would not have been required to document it in any 
retrievable format. Without the requirement to document such information, the 
information would not have been accessible to other FBI personnel. For 
information to be useful, it must be documented in a retrievable form and it 
must be available for consideration and analysis. 


In sum, we believe that Hazmi and Mihdhar’s presence in San Diego 
should have drawn some scrutiny from the FBI. Although unknown at the 
time, documenting their presence in San Diego in a searchable and retrievable 
manner would have provided an opportunity for the FBI to connect information 
in the future. If Hazmi and Mihdhar’s presence in San Diego in 2000 had been 
documented, an FBI indices record check in August 2001, when the FBI 
received information from the CIA that Hazmi and Mihdhar had entered the 
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United States, might have led the FBI to the San Diego information. This 
connection would have provided substantive leads for the New York FBI’s 
effort to locate Mihdhar in August 2001.°” 


3. San Diego FBI’s failure to prioritize counterterrorism 
investigations 


As discussed in Chapter Two, in 1998 the FBI adopted a 5-year strategic 
plan that established the FBI investigative priorities in a 3-tier system. Tier I 
priorities were “foreign intelligence, terrorist, and criminal activities that 
directly threaten the National or Economic Security of the United States.” 
Tier II priorities were “crimes that affect the public safety or undermine the 
integrity of American society: drugs, organized crime, civil rights, and public 
corruption.” Tier III priorities were “crimes that affect individuals and 
property such as violent crime, car theft, and telemarketing scams...” 


On March 15, 1999, shortly after Director of Central Intelligence George 
Tenet asserted the U.S. Intelligence Community was declaring war on Usama 
Bin Laden and al Qaeda, FBI Headquarters established national level priorities 
within its Counterterrorism Program. Bin Laden and al Qaeda, along with the 
Bin Laden-allied Egyptian Islamic Jihad (EIJ) and al Gama’at al Islamiyya 
(IG), were designated as “priority group one” for the FBI’s counterterrorism 
efforts. 


Our review of the Hazmi/Mihdhar chronology revealed no appreciable 
shift in resources by the FBI’s San Diego Field Office in response to these 
changed priorities. We found that prior to September 11, 2001, the actual 
investigative priority for the San Diego Field Office was drug trafficking. 
According to former San Diego Special Agent in Charge William Gore, the 
highest concentration of FBI agents and resources in San Diego was directed at 
combating drug trafficking based on the FBI’s process and procedures used 
each year to set priorities in its field offices. He said that white-collar crime 
was the office’s second priority, and violent crime was its third priority. 


270 As noted, Mihdhar and Hazmi used their own names to open bank accounts, conduct 


financial transactions, obtain state identification cards, purchase a vehicle, obtain telephone 
service, take flying lessons, and rent an apartment while residing in San Diego. 
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Counterterrorism was only the fourth priority for the San Diego FBI office. 
The counterterrorism efforts in San Diego were directed primarily at another 
terrorist organization and related groups not connected to Al Qaeda, and the 
majority of San Diego’s counterterrorism investigations targeted activities 
related to the indirect support of terrorism conducted by those groups. 


We found that the San Diego FBI focused little to no investigative 
activity on al Qaeda prior to September 11. San Diego FBI personnel stated to 
us that they had believed there was no significant al Qaeda activity in San 
Diego based on information from their sources and investigative activities. 
The former supervisor of the San Diego counterterrorism squad explained their 
job at the field office level was to “shake the tree and see what fell out” in 
relation to potential terrorism activities in their area. Although San Diego 
agents assigned to counterterrorism conceded they had received little to no 
specific training concerning Bin Laden or al Qaeda, they asserted that al Qaeda 
did not have a significant presence in San Diego prior to September 11. 


Yet, al Qaeda was present in San Diego, unbeknownst to the FBI. Hazmi 
and Mihdhar resided in San Diego. Unfortunately, the San Diego agents were 
not focusing on al Qaeda. Even though FBI Headquarters had designated al 
Qaeda as the number one counterterrorism priority, the San Diego FBI was not 
attempting to identify individuals that were associated with al Qaeda. 


Since September 11, many San Diego agents have been moved from 
other squads and assigned to counterterrorism. Significantly, the San Diego 
office opened a large number of intelligence investigations on potential al 
Qaeda subjects immediately after September 11. Obviously, the focus and 
priorities dramatically changed after September 11. But there is no reason to 
believe the al Qaeda presence in San Diego began only after September 11. If 
San Diego’s focus on counterterrorism and al Qaeda had occurred earlier in 
San Diego, there would have been a greater possibility, though no guarantee, 
that Hazmi’s and Mihdhar’s presence in San Diego may have come to the 
attention of the FBI before September 11. 


However, it is important to note that San Diego’s allocation of resources 
before September 11 and the lower priority it gave to the Counterterrorism 
Program were not atypical of FBI field offices before September 11. In an 
OIG September 2002 audit report entitled “A Review of the Federal Bureau of 
Investigation’s Counterterrorism Program: Threat Assessment, Strategic 
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Planning, and Resource Management,” we found that “Although the FBI has 
developed an elaborate, multi-layered strategic planning system over the past 
decade, the system has not adequately established priorities or effectively 
allocated resources to the Counterterrorism Program.” 


Furthermore, the OIG report found that resources were not allocated 
consistent with the FBI’s priorities — particularly at the field office level — 
because of the lack of “management controls” in the FBI’s “complicated and 
paper-intensive strategic planning process.” Instead of allocating resources 
based on FBI priorities, field offices allocated resources primarily based on 
previous caseloads in the field office. According to the report, prior to 
September 11, “the Bureau devoted significantly more special agent resources 
to traditional law enforcement activities such as white collar crime, organized 
crime, drug, and violent crime investigations than to domestic and international 
terrorism investigations.” For example, in 2000 twice as many FBI agents 
were assigned to drug enforcement than to counterterrorism. Thus, the San 
Diego’s office allocation of resources was not different from many other FBI 
field offices, despite the stated priorities of the FBI. 


C. Events in the spring and summer of 2001 


As described in the factual chronology, the FBI had several opportunities 
in the spring and summer of 2001 to obtain critical intelligence about Mihdhar 
and Hazmi. Although the FBI and the CIA were discussing Mihdhar, Khallad, 
and the Cole investigation throughout the spring and summer of 2001, the FBI 
did not become aware of the critical intelligence involving Mihdhar’s U.S. visa 
and subsequent travel to the U.S. until late August 2001. As we discussed 
above, we believe that systemic problems regarding information sharing 
between the two agencies contributed to the FBI’s failure to obtain this 
information earlier. But restrictions within the FBI also contributed to the 
FBI’s failure to acquire critical information about Hazmi and Mihdhar before 
September 11. In this section, we discuss those problems. 


1. Restrictions on the flow of information within the FBI 


By the summer of 2001, the effect of the various restrictions within the 
FBI on information sharing — commonly referred to as “the wall” — had 
resulted in a nearly complete separation of intelligence and criminal 
investigations within the FBI. This separation greatly hampered the flow of 
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information between FBI personnel working criminal and intelligence 
investigations, including information concerning Hazmi and Mihdhar in the 
summer of 2001. 


As discussed in Chapter Two, in late 1999 the FISA Court had become 
the “wall” for purposes of passing FISA information on targets of a particular 
terrorist organization from FBI intelligence investigations to criminal 
investigations. Any information that intelligence agents wanted to give to 
criminal agents had to be provided to the FBI’s NSLU, which then provided it 
to OIPR, which then provided it to the FISA Court, which then had to approve 
the passage of the information to criminal agents. In addition, after the FISA 
Court was notified in the fall 2000 about errors in approximately 100 FISA 
applications, a significant portion of which related to the FBI’s representations 
about the “wall” procedures in al Qaeda cases, the FISA Court imposed new 
restrictions on the FBI’s handling of FISA information. The FISA Court 
required a certification from all individuals who received FISA information 
stating that they understood this requirement. 


The FISA Court exempted CIA and NSA personnel, who often received 
FISA information from the FBI, from this certification requirement. But the 
FISA Court required that the CIA and NSA indicate on the information they 
provided to the FBI whether the information had been obtained based on FISA 
information previously provided to them by the FBI (called “FISA-derived 
information”). In response, the NSA decided that it was more efficient not to 
delay dissemination of intelligence while checking to see if it was derived from 
FISA, and it therefore placed a caveat on all NSA counterterrorism reports to 
the FBI stating that before information could be considered for dissemination 
to criminal personnel, the FBI had to check with the NSA General Counsel 
about whether the intelligence was FISA-derived. Once the NSA determined 
whether the information was FISA-derived, the FBI had to comply with the 
wall procedures for passing FISA-derived information to criminal agents or 
prosecutors. If the information was not FISA-derived, it could be passed 
directly. 


FBI Headquarters personnel became wary that any involvement of 
criminal agents in intelligence investigations could present problems for the 
FBI with the FISA Court. A former ITOS unit chief described the FISA 
Court’s certification requirement as a “contempt letter” and said that it “shut 
down” the flow of information in the FBI. He further stated that FBI 
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Headquarters employees became worried that any misstep in handling FISA 
information could result in harm to their careers because an FBI agent was 
banned from appearing before the FISA Court and OPR began an investigation 
on him. These three factors — the Court had become the screener in al Qaeda 
cases, the certification requirement imposed by the FISA Court, and concerns 
about violating the Court’s rules — combined to stifle the flow of intelligence 
information within the FBI. FBI employees described this to the OIG as the 
walls within the FBI becoming “higher” over time. New York FBI agents told 
the OIG that the walls were viewed as a “maze” that no one really understood 
or could easily navigate. 


As we discuss below, these walls affected the FBI personnel’s 
discussions about the Mihdhar information at the June 11, 2001, meeting in 
New York and the FBI’s decision to open an investigation to locate Mihdhar in 
August 2001. 


2. Problems at the June 11 meeting 


At the June 11, 2001, meeting, FBI Headquarters and CIA CTC 
personnel discussed with New York FBI investigators issues relating to the 
Cole investigation. At the time of this meeting, the FBI analyst who we call 
Donna had received information from the CIA concerning travel in January 
2000 of an al Qaeda operative named Khalid al-Mihdhar to Malaysia through 
Dubai. Donna also had received surveillance photographs from the CIA 
showing Mihdhar meeting with other unidentified al Qaeda operatives in 
Malaysia.” 


After receiving the information from the CIA, Donna had conducted her 
own record check on Mihdhar in CTLink and discovered the NSA information 
from late 1999 and early 2000 associating Mihdhar with a suspected terrorist 
facility in the Middle East linked to al Qaeda activities and his plans to travel 
to Malaysia in January 2000. 


271 Although not shared with Donna or known to anyone else in the FBI, the CIA also 


knew in June 2001 that Mihdhar had a U.S. visa, that Mihdhar’s associate -- Hazmi -- had 
traveled to the United States in January 2000, and that the Cole mastermind Khallad had 
been identified in one of the Kuala Lumpur surveillance photographs. 
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This NSA intelligence about Mihdhar would have been important to the 
FBI agents conducting a criminal investigation of the Cole attacks. However, 
Donna did not share this information with the criminal agents at the June 11 
meeting because of concerns about the wall. By this time, the FBI was 
operating under the requirement that all NSA counterterrorism information had 
to be reviewed by the NSA’s General Counsel’s Office for a determination of 
whether it was FISA-derived before it could be considered for dissemination to 
criminal agents. Because she had not yet asked the NSA whether the 
information could be passed, Donna did not provide the New York agents with 
any of the NSA information. That information would have been important to 
the New York agents who were working the Cole investigation because they 
specialized in al Qaeda operations and at the June 11 meeting showed great 
interest in the Malaysia meetings and Mihdhar. That information may also 
have provided the criminal agents with additional leads and could have led to 
the information that Mihdhar and Hazmi had traveled to the United States in 
January 2000. 


We recognize that the caveat on sharing any NSA counterterrorism 
information did not mean that the criminal agents were prohibited from ever 
obtaining access to the NSA information on Mihdhar. But if the information 
was FISA-derived, the caveat created a delay in the criminal agents receiving 
the information because of the lengthy procedures that had to be followed to 
share the information with them. 


With respect to the information Donna had received from the CIA about 
the Malaysia meetings, Donna showed the photographs to New York agents 
and asked whether they could identify Cole participant Fahd al Quso in the 
photographs. After one of the agents made a tentative identification, the agents 
asked questions about Mihdhar and the photographs. The agents continued to 
ask Donna questions about Mihdhar, the Malaysia meetings, and the 
photographs on June 11 after the meeting. As we discussed above, it is unclear 
how much questioning occurred during the actual meeting and how much 
occurred after the meeting. Donna was unable to answer most of the agents’ 
questions because she had not obtained the information from the CIA. This, in 
our view, was not because of the wall, but was because of Donna’s failure to 
plan the meeting adequately or ask sufficient questions from the CIA in 
advance of the meeting. 
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First, we believe the planning for the June 11 meeting was flawed. 
Although Donna and other IOSs frequently traveled to New York to work on 
the Cole investigation, she told the OIG that this was the first time that she had 
arranged for a meeting involving CTC personnel in New York. Yet, according 
to what the meeting participants told the OIG, the purpose and the agenda of 
the meeting were not clear. The participants agreed that they knew there was 
going to be a discussion of the investigative results on the Cole attack. The 
New York agents believed that the CTC and FBI Headquarters had information 
to share with New York. Donna and the CTC participants, however, described 
the meeting as a “brainstorming” session to determine what new leads could be 
pursued and what FBI Headquarters could do to assist New York. 


No agenda was prepared and no supervisors were consulted for their 
input about the meeting. Even though Donna said that she called the meeting 
to explore further leads or avenues of investigation in the Cole case, she 
apparently did not ask the CTC participants to be prepared to present 
information or answer questions. Mary and Peter told the OIG they were not in 
a position to discuss the Cole investigation. Mary said she was not up to speed 
about the Cole investigation or the Malaysia meetings. Peter told the OIG that 
as an analyst at the CIA, he did not have authority to discuss CIA information 
at the meeting and he was merely “tagging along.” 


Donna told the OIG that she considered Mary to be another FBI 
employee at the meeting, and for this reason did not provide her with any 
specific instructions in preparation for the meeting. Donna also said that she 
had not invited Peter and because she was not in his chain of command, she did 
not ask him to be prepared. However, the New York agents we interviewed 
told the OIG that they believed that CTC personnel were coming to the 
meeting in part to share information with them. The fact that all the 
participants we interviewed described the meeting as unproductive and a 
“waste of time” highlighted that a more useful exchange of information could 
have occurred. 


With respect to the Kuala Lumpur photographs, Donna had obtained only 
limited information from CIA employee John about the photos when she 
received them. She did not ask general background questions such as whether 
anyone else in the photographs had been identified, or what else was known 
from the Malaysia meetings. Donna told the OIG that because she believed the 
CIA provided her with everything she was entitled to know, she did not have 
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an in-depth discussion about the photographs. John said he did not recall 
anything about his discussions with Donna regarding the Kuala Lumpur 
photographs. 


Donna told the OIG that when the New York agents asked her questions 
about Mihdhar, the Malaysia meetings, and the photographs, she thought that 
they were reasonable questions, but she did not know the answers. She stated 
that at the time she obtained the Kuala Lumpur photographs from the CIA, she 
believed that they were only potentially related to Quso and their significance 
to the Cole would hinge on whether Quso was in the photographs. 


We believe Donna should have asked the CIA additional questions about 
the photographs. She had reason to believe Quso, a key individual in the Cole 
investigation, may have attended the Malaysia meetings. Given her interest in 
whether Quso had attended the meetings, she should have wanted to ascertain, 
and asked the CIA, what, if anything, was known about the purpose of the 
Malaysia meetings, who were the other participants at the meetings, what was 
known about the participants, and any other available information. 


Donna also did not ask the CIA whether there were additional photos or 
documentation. Donna told the OIG she was unaware that there could have 
been additional photographs or other relevant information available. We 
believe that someone in her position should have known or at least asked for 
additional information about the subject of the photographs in preparation for 
the meeting. 


We also were troubled by Donna’s inadequate efforts to obtain additional 
information after the June 11 meeting, particularly information about the 
Malaysia meetings, since it had been the subject of a dispute between Donna 
and Scott. Although Donna told the New York agents that she would check 
with the CIA about additional information regarding the photographs and the 
Malaysia meetings, Donna made little effort to obtain this information until 
two months later, in August 2001. Donna told the OIG that she believes that 
she made some unsuccessful follow-up phone calls to Peter and John about the 
photographs. It is not clear from the documentary evidence how much Donna 
did before August to obtain the information, but she did not provide additional 
information to the New York agents about the photographs for at least two 
months. We recognize that FBI analysts were overwhelmed with assignments 
and had to juggle many responsibilities, however, given the possible 
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connections of this information to the Cole investigation, we believe Donna 
should have made more aggressive and timely efforts to obtain this information 
soon after the June 11 meeting and to keep the New York agents informed 
about what her follow-up efforts were. 


By the same token, Scott, the New York Cole case agent, did little to 
follow up after the June 11 meeting to obtain information he requested about 
the Malaysia meeting. Scott told the OIG he “often” asked Donna about the 
status of the information, but he was not provided any such information. 
Donna contended that Scott did not follow up on his June 11 requests. We 
found no evidence such as e-mails or other documents to support Scott’s claim 
that he raised the issue often with Donna. We believe that neither Donna nor 
Scott made significant efforts after the meeting to obtain the information. 


3. The FBI’s investigation in August 2001 to find Mihdhar and 
Hazmi 


As discussed above, on August 22, 2001, the FBI learned that Mihdhar 
and Hazmi had entered the United States in January 2000, that Mihdhar had 
again flown to New York on July 4, 2001, and that there was no record of 
either of them leaving the country. The FBI also learned that Khallad had been 
identified in the Kuala Lumpur photographs. Upon discovery of this 
information, the FBI opened an intelligence investigation in New York in an 
effort to locate Mihdhar. 


Once again, however, the separation between intelligence and criminal 
information affected who could receive access to the information about Hazmi 
and Mihdhar. This interpretation of the wall also hampered the ability of the 
FBI New York agents working on the Cole investigation to participate in the 
search for Hazmi and Mihdhar. In addition, we found that the FBI’s efforts to 
locate Hazmi and Mihdhar were not extensive. We do not fault the case agent 
assigned to locate them. He was new and not instructed to give the case any 
priority. Rather, we found that the FBI New York did not pursue this as an 
urgent matter or assign many resources to it. 
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a. The effect of the wall on the FBI’s attempts to locate 
Mihdhar 


As discussed above, Donna drafted an EC to the New York FBI 
requesting it open an investigation to locate Mihdhar. She also called Chad, 
the FBI New York agent who primarily handled intelligence investigations for 
the Bin Laden squad, to give him a “heads up” about the matter, and she 
subsequently sent the EC to him. She wrote in the e-mail that she wanted to 
get the intelligence investigation going and the EC could not be shared with 
any of the agents working the Cole criminal case. Chad forwarded the EC to 
his squad supervisor, Jason, who nevertheless disseminated the EC via e-mail 
within the Bin Laden squad, including to the criminal agents assigned to the 
Cole investigation. 


Scott read the EC and contacted Donna regarding it. Donna informed 
Scott that he was not supposed to have read the EC because it contained NSA 
information that had not been cleared to be passed to criminal agents. Donna 
told Scott that he needed to destroy his copy. Scott responded that the effort to 
locate Mihdhar should be part of the Cole criminal investigation, and he argued 
with Donna regarding the designation of the investigation as an intelligence 
matter. Donna asserted that, because of the wall, criminal agents were not yet 
entitled to the underlying intelligence provided by the NSA, and without that 
predicating material, the FBI could not establish any connection between 
Mihdhar and the Cole criminal investigation. 


Scott, Donna, and acting UBL Unit Chief Rob then spoke via conference 
call. Scott argued that the investigation should be opened as a criminal 
investigation and that more resources and agents could be assigned to a 
criminal investigation by New York. He also argued that criminal investigative 
tools, such as grand jury subpoenas, were far quicker in obtaining information 
than the tools available in intelligence investigations. 


Donna consulted with an NSLU attomey, Susan. According to Donna, 
Susan concurred that the matter should be handled as an intelligence 
investigation and that because of the wall, a criminal agent could not 
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participate in the search for or any interview of Mihdhar.*”* When Donna 
advised Scott of Susan’s opinion in an e-mail message, Scott responded by e- 
mail that he believed the wall was inapplicable. Scott ended his message by 
suggesting that because of the NSLU’s position, people were going to die and 
that he hoped that NSLU would stand by its position then. 


The way that FBI Headquarters handled the Mihdhar information 
reflected its interpretation of the requirements of the wall prior to September 
11. First, because the predication for the search for Mihdhar originated from 
the NSA reports, this information could not be immediately shared with 
criminal agents. Instead, it first had to be cleared for dissemination by the 
NSA, which would determine whether the intelligence was based on FISA 
information. If so, the information had to be cleared for passage to the criminal 
agents — the information had to be provided to the NSLU, which then provided 
the information to OIPR, which then provided it to the FISA Court, which then 
had to approve the passage of this information to criminal agents. In fact, the 
limited INS information concerning Mihdhar’s and Hazmi’s entries into the 
United States was the only unrestricted information in the EC immediately 
available to the criminal investigators. 


As in the Moussaoui case, the decision to open an intelligence 
investigation resulted in certain restrictions. FBI Headquarters employees 
understood that they needed to ensure that they avoided any activities that the 
FISA Court or OIPR could later deem “too criminal” and could use as a basis 
to deny a FISA application. This included preventing a criminal agent from 
participating in a subject interview in an intelligence investigation. While 
Scott was correct that the wall had been created to deal with the handling of 
only FISA information and that there was no legal barrier to a criminal agent 
being present for an interview with Mihdhar if it occurred in the intelligence 
investigation, FBI Headquarters and NSLU believed that the original wall had 
been extended by the FISA Court and OIPR to cover such an interview. 


Scott’s frustration over the wall was similar to Henry’s in the Moussaoui 
investigation, when Henry was told by Don that seeking prosecutor 


272 As discussed above, Susan told the OIG that she did not recall this discussion with 
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involvement prematurely could potentially harm any FISA request. Scott, like 
Henry, wanted to pursue a criminal investigation and became frustrated when 
he was advised by FBI Headquarters that he could not proceed in the manner 
he deemed appropriate. Scott’s perception was that FBI Headquarters had 
misconstrued “the wall” and the wall had been inappropriately expanded. He 
told the OIG that he believed the wall should only relate to FISA or FISA- 
derived information. Like the Minneapolis FBI, Scott believed that he was 
being “handcuffed” in the performance of his job and that FBI Headquarters 
“erred on the side of caution” in its approach to intelligence information. 


FBI Headquarters, on the other hand, acted in accordance with its 
experience with OIPR and the FISA Court. FBI Headquarters believed that 
OIPR and the FISA Court required strict adherence to the procedures for the 
passage of intelligence information to criminal investigations and required 
separating criminal and intelligence investigations. Donna explained that the 
FISA Court’s mandates resulted in the need for the FBI to create a near 
complete separation between intelligence and criminal investigations in order 
to effectively use intelligence information. Rob also told the OIG that there 
were “land mines” in dealing with intelligence versus criminal information, 
and it was difficult to appropriately straddle the two sides. 


Our review of this case showed that the wall had been expanded to create 
a system that was complex and had made it increasingly difficult to effectively 
use intelligence information within the FBI. The wall — or “maze of walls” as 
one witness described it — significantly slowed the flow of intelligence 
information to criminal investigations. The unintended consequence of the 
wall was to hamper the FBI’s ability to conduct effective counterterrorism 
investigations because the FBI’s efforts were sharply divided in two, and only 
one side had immediate and complete access to the available information. 


The wall was not, however, the only impediment in the FBI’s handling of 
the investigation to find Mihdhar and Hazmi. We found there were also other 
problems in how the search for Mihdhar and Hazmi was handled. 


b. Allocation of investigative resources 


We found that prior to the September 11 attacks, the New York Field 
Office focused its al Qaeda counterterrorism efforts on criminal investigations, 
but it did not expend a similar effort on intelligence investigations or the 
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development of intelligence information. New York agents told the OIG they 
believed that criminal prosecution was the most effective tool in combating 
terrorism. They asserted that criminal investigations are also a preventive 
activity and the FBI had always focused on preventing terrorism, even before 
September 11. They pointed to the TERRSTOP investigation in 1993, an 
investigation to uncover a terrorist plot to attack New York City landmarks, 
and the criminal investigation into the East African embassy bombings. 


Prosecutors also argued that criminal investigations and prosecutions are 
an effective preventive measure against terrorism. Testifying before the Joint 
Intelligence Committee, Mary Jo White, the former U.S. Attorney for the 
Southern District of New York (SDNY), stated, “[W]e viewed the terrorist 
investigations and prosecutions we did from 1993-2002 as a prevention tool.” 
Patrick Fitzgerald, currently the U.S. Attorney for the Northern District of 
Illinois and formerly an Assistant U.S. Attorney in the SDNY, told us that it is 
a misconception that there has to be a difference between prosecution and 
gathering intelligence. He added that the SDNY prosecutions produced a 
“treasure trove of [intelligence] information.” 


However, prosecutors also realized criminal investigation and 
prosecution were not the only means of countering terrorism. White stated, 
“the counterterrorism strategy of our country in the 1990s was not, as I have 
read in the media, criminal prosecutions.” She further stated, “none of us 
considered prosecutions to be the country’s counterterrorism strategy, or even a 
major part of it.” As Fitzgerald told us, “in order to connect the dots, you need 
people to gather the dots.” 


Although we agree criminal investigations are a highly effective 
counterterrorism tool, intelligence investigations were not given nearly the 
same level of resources and attention in the FBI’s New York Field Office 
before September 11, 2001. This criminal focus was clear in the assignment of 
personnel on the New York Bin Laden squad. From October 2000 to June 
2001, only one agent on the Bin Laden squad was designated as the 
“intelligence” agent — the agent we call “Chad.” The remainder were 
designated as “criminal” agents.*” Chad told us that he was inundated with 


273 One criminal agent worked on intelligence matters on a part-time basis. 
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intelligence investigations and information, and he rarely had enough time 
even to review all the incoming Bin Laden intelligence information, let alone 
to digest, analyze, or initiate the procedures to pass the information to the 
criminal agents where applicable. Chad also told us that the “intelligence” 
agent designation was “not a desirable position” within the Bin Laden squad. 
He described himself as the “leper” on the squad due to “the wall.” 
Furthermore, Chad stated that the intelligence side of the squad received far 
less and lower quality resources. 


The handling of the investigation to locate Mihdhar provides a clear 
indication of the primacy of the criminal over intelligence investigations in the 
New York office. On August 28, 2001, the New York Field Office opened an 
intelligence investigation to locate Mihdhar based upon Donna’s EC. Donna 
told the OIG that she believed there was some urgency to the Mihdhar 
investigation, not because of any evidence that he was operational, but because 
he could leave the United States at any time and the opportunity to find out as 
much as possible about him would be lost. She said she therefore called Chad 
about the EC in advance, which she did not normally do. 


However, when she sent the EC to New York, she assigned the matter 
“routine” precedence, the lowest precedence level. When asked about this 
discrepancy, Donna told the OIG that the Mihdhar investigation was “no 
bigger” than any other intelligence investigation that the FBI was pursuing at 
the time. 


The New York Bin Laden squad relief supervisors, who we call “Jay” 
and “David,” told the OIG that they recognized that there was some urgency to 
the Mihdhar investigation. Yet, the FBI in New York did not treat it like an 
urgent matter. The investigation was given to an inexperienced agent — 
”Richard” — who had only recently been assigned to the Bin Laden squad. This 
was his first intelligence investigation. As one of the largest field offices in the 
FBI, with over 300 agents assigned to the JTTF, the New York Field Office 
could have assigned additional or more experienced agents who were not 
involved in the Cole criminal investigation to assist Richard. However, the 
New York Field Office Bin Laden Squad was focused on criminal 
investigations. As a result, the designation of the Mihdhar matter as an 
intelligence investigation, as opposed to a criminal investigation, undermined 
the priority of any effort to locate Mihdhar. 
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Finally, we also noted that there was a clear predicate for a criminal 
investigation that no one appeared to notice at the time. In her EC, Donna 
noted that Mihdhar had previously traveled to the United States, according to 
information she had obtained from the INS. After the FBI’s intelligence 
investigation was opened, she obtained and forwarded to Richard a copy of 
Mihdhar’s June 2001 visa application on which he stated that he had not 
previously been issued a visa and had never traveled to the United States. 
Thus, there was a clear basis to charge Mihdhar criminally with false 
statements or visa fraud. Significantly, this information had been provided to 
the FBI without the restrictive caveats placed on NSA reports and other 
intelligence information. As a result, if Mihdhar had been found, he could 
have been arrested and charged with a criminal violation based on the false 
statements on his visa application. However, the FBI did not seem to notice 
this when deciding whether to use criminal or intelligence resources to locate 
Mihdhar. 


D. Individual performance 


This section summarizes the performance of individual FBI employees in 
the Hazmi and Mihdhar matter. While none of them committed misconduct, 
we believe that several FBI employees did not perform their duties as well as 
they could have and should have. We address in turn the FBI employees 
involved in each of the five lost opportunities. 


In this section, we do not discuss the performance of individual CIA 
employees. However, we believe that a significant cause of the failures in the 
sharing of information regarding the Hazmi and Mihdhar case is attributable to 
the actions of the CIA employees. It is the responsibility of the CIA OIG to 
assess the accountability of the actions of CIA employees. 


1. Dwight 


In January 2000, intelligence information was developed about Hazmi, 
Mihdhar, and other al Qaeda operatives meeting in Malaysia. Dwight, an FBI 
detailee to the CTC’s Bin Laden Unit, read the CIA cables about the Malaysia 
meeting. The cables indicated that Mihdhar had a U.S. visa and that he listed 
New York on the visa application as his intended destination. Dwight 
recognized the significance of this information to the FBI and drafted a CIR to 
pass this information to the FBI. 
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Unfortunately, his draft CIR was never sent. A notation added to the CIR 
suggested that it was held at the request of the CIA’s Deputy Chief of the Bin 
Laden Unit. Several FBI detailees accessed the CIR, and Dwight inquired 
about it again five days later, asking the Deputy Chief in an e-mail whether it 
was going to be sent or whether he needed to “remake” it in some way. We 
found no response to his e-mail, and none of the participants, including Dwight 
and the Deputy Chief, said they remembered this CIR at all. 


We believe the primary responsibility for the failure to pass this 
information rests with the CIA. The evidence indicates that the CIA did not 
provide permission for the CIR to be sent.*”* However, we also believe that 
Dwight should have followed up as much as necessary to ensure that the 
information was sent to the FBI. Although we found evidence that he inquired 
once about the disposition of the CIR, we found no additional evidence that he 
continued to follow up to ensure that the information was sent. If Dwight was 
stymied in his attempt to learn about the disposition of the cable, or if the CIA 
gave no reasonable explanation for why the information was not being sent, he 
could have brought this issue to the attention of another supervisor in the CTC. 
In our view, Dwight took the commendable initiative to draft the CIR to share 
the information with the FBI, but did not follow through adequately to ensure 
that it was sent, and the information in the CIR was not provided to the FBI 
until shortly before the September 11 attacks. 


2. Malcolm 


Malcolm was a New York FBI agent detailed for several years to the 
CTC. He told the OIG that he understood his role at the CTC was, among 
other things, to be the “eyes and ears” of the New York Field Office. We do 
not believe that he performed this role sufficiently. He acknowledged to the 
OIG that one of his duties was “to monitor” New York Field Office cases, but 
he said he read only the cables that he thought were “interesting,” generally 


274 The CIA has asserted that the information in the CIR was sent to the FBI through 
another cable, which may be why the CIR was not sent. A CIA cable stated that Mihdhar’s 
travel documents, including a multiple entry U.S. visa, had been copied and passed “to the 
FBI for further investigation.” As discussed above, however, we found no evidence that this 
cable was correct and that this information had actually been provided to the FBI. 
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based solely on his review of the cable subject line. In addition, while he said 
his role was to “facilitate inquiries of mutual interest,” the only example he 
could provide was his acting as a liaison for FBI offices around the country by 
following up on tracing requests and reporting on their status. This was not 
very onerous or substantive. We believe that FBI management is primarily 
responsible for failing to provide the FBI detailees to the CTC, including 
Malcolm, with clear duties, direction, and supervision. But we believe 
Malcolm should have done more and taken more initiative in performing his 
duties at the CTC. 


3. Stan 


For several months in 2000, Hazmi and Mihdhar lived as boarders in the 
house of an FBI informational asset. The asset briefly mentioned the two 
boarders to his FBI control agent, who we call “Stan.” Stan did not document 
this information, seek to learn the boarders’ full identities, or conduct any 
checks on them. 


No FBI policy required Stan to seek or document this type of information 
from the asset, and we found differences among the other FBI agents who we 
interviewed about whether they would have sought such information from an 
asset. While Stan did not violate any specific FBI policy, we believe it would 
have been a better and more prudent practice for him to have sought at least 
minimal information from his asset about the boarders living with him. The 
asset knew little about the boarders, and the boarders could have compromised 
information provided by the asset to the FBI. 


Moreover, FBI policy required Stan to continually evaluate the asset’s 
credibility and provide a yearly evaluation report on the asset. Stan’s yearly 
report on this asset was minimal, with a bare attestation of the asset’s bona 
fides. It contained no indication of what evidence Stan had used to make these 
attestations. While we do not suggest that Stan had to conduct extensive 
reviews of everyone living with the asset, Stan’s actions in following up on this 
information were not particularly thorough or aggressive. 


4. Max 


In January 2001, a joint FBI/CIA source identified Khallad in 
photographs of the Malaysia meetings. Because the FBI ALAT who was 
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involved in the handling of the source, Max, was unable to speak any of the 
joint source’s languages, a CIA employee conducted the debriefings of the 
source, including the debriefing in which the source identified Khallad. We 
concluded that Max was not informed of the source’s identification of Khallad 
from the Kuala Lumpur surveillance photograph, either at the time of the 
identification or afterwards. Although CIA cables covering the debriefing 
described the identification of Khallad, these were not shared with Max. 
Instead, he saw CIA TDs that did not contain the information about the 
identification. 


CIA documents do not indicate that the ALAT was informed of the 
identification, and no other evidence indicates that the ALAT knew. We found 
that the ALAT included detailed descriptions in his reports of other 
information from the source, which indicates he was not provided the 
information about the identification of Khallad. We also found that the New 
York FBI agents who interviewed the source in February 2001 were not 
informed of the identification of Khallad. In sum, we believe the ALAT did 
not learn about the source’s identification, not that he knew about identification 
but failed to share this information with others. 


We believe that, as the ALAT, Max should have been more familiar with 
the CIA’s reporting process. He was not aware that the CIA’s TDs contained 
only a part of the information obtained during the source debriefings. 
Although our review revealed that many FBI employees operated with 
misunderstandings about the ways the CIA recorded and reported intelligence 
information, a significant function of the ALAT position is to interact with the 
CIA. Had he recognized that he could not rely on TDs for full reporting about 
the source’s information, he could have asked his CIA counterpart directly for 
any additional information from the source, and the ALAT may have learned 
about the identification of Khallad. In addition, given Max’s concern that he 
provide FBI Headquarters with all of the information reported by the source, it 
would have been prudent for him to consult with the CIA case officer and ask 
sufficient questions to ensure that he had received all of the information. We 
found no indication that he did so. 


5. Donna 


Donna, the FBI analyst who worked on the investigation of the Cole 
attacks, planned a June 11, 2001, meeting with the Cole investigators and CIA 


358 


employees to discuss information relating to the Cole investigation. She 
deserves credit for organizing this meeting and seeking to share intelligence 
information with the Cole investigators. However, we fault her performance in 
two respects. First, we found that the meeting was poorly planned, and Donna 
did not clearly communicate the purpose of the meeting to the participants. 
Donna also failed to obtain significant information prior to the meeting that 
could have been shared with the investigators about the Malaysia meetings. 
After the meeting, although Donna devoted a significant amount of time to the 
Cole investigations, she did little specific follow-up to provide answers to the 
investigators about their logical questions regarding the Malaysia meetings. 
We believe she did not do all she could have to acquire that information for the 
New York agents, even though she had said that she would as a result of their 
discussion at the June 11 meeting. As a result, the FBI missed another 
opportunity to focus on Mihdhar and Hazmi earlier than it did. 


When Donna finally learned from Mary on August 22, 2001, that Hazmi 
and Mihdhar were in the United States, Donna quickly and appropriately took 
steps to have the FBI open an investigation to locate them. She personally 
called the New York Bin Laden intelligence agent and told him about the 
matter. This was an unusual step to call the agent directly, and it suggested 
that the investigation should be given some priority. However, when she sent 
the EC to New York, she designated the EC as having a routine precedence. 
Donna’s actions indicated some urgency in the need for the investigation yet 
the subsequent EC did not convey any urgency. The New York Field Office 
assigned the case immediately, and the agent began working on the case within 
two business days of the assignment. If the EC had conveyed urgency, the FBI 
New York Field Office might have assigned additional or more experienced 
agents to locate Mihdhar and Hazmi and initiated the search sooner. 


6. Rob 


We believe that Rob, as Donna’s supervisor, is also responsible for 
Donna’s failures. While the FBI at the time permitted IOSs to make significant 
decisions, often with little supervisory input, we believe that as a supervisor, he 
should have ensured that she was handling the June 11 meeting appropriately 
and, if necessary, become involved with the planning or execution of the 
meeting. Although Donna often traveled to New York to work on the Cole 
investigation, the June 11 meeting involved the CIA and an AUSA, which 
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should have led to more supervisory involvement in the purpose, agenda, and 
outcome of the meeting. But Rob had little supervisory involvement with it, 
either before or after the meeting. In addition, although Donna drafted the EC 
requesting the investigation of Mihdhar, the EC was ultimately approved and 
sent by Rob. Therefore, we believe he also bears some responsibility for 
failing to ensure that the appropriate precedence level was used on the EC. 


7. Richard 


We do not fault Richard for his limited investigation, which was still in 
the nascent stages by the time of the September 11 attacks. As we described 
above, Richard took logical steps to try to locate Mihdhar and Hazmi, such as 
completing a lookout for Mihdhar with the INS, requesting local criminal 
history checks, checking with New York hotels about Hazmi and Mihdhar, and 
conducting commercial database checks on them. However, there were many 
more investigative steps that could have been pursued, in New York and 
elsewhere, had the investigation been assigned greater priority and had the FBI 
provided more resources to this investigation. The FBI was not close to 
locating Hazmi and Mihchar when they participated in the September 11 
attacks. We believe that the FBI in New York should have assigned the matter 
more priority than it did. 


8. Mary 


Mary was assigned by her CIA managers in May 2001 with finding and 
reviewing the CIA cables relating to the Malaysia meetings and their potential 
connection to the Cole attack. Mary did not find the relevant CIA cable traffic 
until late July and mid-August 2001. She told the OIG that she did not have 
time to focus on this assignment until then. Upon discovering on August 21 
that Hazmi and Mihdhar had traveled to the United States, she immediately 
passed this information to the FBI. 


We recognize that the disparate pieces of information about the Malaysia 
meetings were not easy to connect and that the task of developing patterns 
from seemingly unrelated information was complex. Yet we question the 
amount of time that elapsed between Mary’s assignment and her discovery of 
the important information. As we discussed previously, however, Mary’s 
assignments were directed and controlled by her managers in the CTC. We, 
therefore, leave this issue to the CIA OIG for its consideration. 
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V. OIG conclusions 


In sum, we found individual and systemic failings in the FBI’s handling 
of information regarding the Hazmi and Mihdhar matter. The FBI had at least 
five opportunities to learn about their presence in the United States and to seek 
to find them before September 11, 2001. Much of the cause for these lost 
opportunities involved systemic problems. We found information sharing 
problems between the CIA and the FBI and systemic problems within the FBI 
related to counterterrorism investigations. The systemic problems included 
inadequate oversight and guidance provided to FBI detailees at the CIA, the 
FBI employees’ lack of understanding of CIA procedures, the inconsistent 
documentation of intelligence information received informally by the FBI, the 
lack of priority given to counterterrorism investigations by the FBI before 
September 11, and the effect of the wall on FBI criminal investigations. 


Our review also found that the CIA did not provide information to the 
FBI about Hazmi and Mihdhar when it should have and we believe the CIA 
shares significant responsibility for the breakdown in the Hazmi and Mihdhar 
case. However, the FBI also failed to fully exploit the information that was 
made available to them. In addition, the FBI did not assign sufficient priority 
to the investigation when it learned in August 2001 that Hazmi and Mihdhar 
were in the in the United States. While we do not know what would have 
happened had the FBI learned sooner or pursued its investigation more 
aggressively, the FBI lost several important opportunities to find Hazmi and 
Mihdhar before the September 11 attacks. 
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CHAPTER SIX 
RECOMMENDATIONS AND CONCLUSIONS 


Our review found many deficiencies in the FBI’s handling of intelligence 
information related to the September 11 attacks. In addition to individual 
failures, which we detail at the end of each chapter, we found significant 
systemic problems that undermined the FBI’s Counterterrorism Program. For 
example, before the September 11 attacks the FBI lacked an effective 
analytical program, failed to use the FISA statute fully, and was inadequately 
organized to disseminate timely and sufficient information within the 
Intelligence Community. As we detailed in this report, these systemic 
problems significantly affected the FBI’s handling of the Phoenix Electronic 
Communication (EC), the Moussaoui investigation, and the pursuit of 
intelligence information relating to Hazmi and Mihdhar, two of the September 
11 terrorists. 


Since September 11, 2001, the FBI has taken numerous steps to 
reorganize and strengthen its Counterterrorism Program. In this report, we 
have not analyzed each of these changes, many of which are substantial, 
ongoing, and evolving. The National Commission on Terrorist Attacks Upon 
the United States (9/11 Commission), as well as other OIG and GAO reviews, 
is assessing the impact of the changes in the FBI since September 11, 2001. 


In this chapter, we make broad systemic recommendations to address the 
specific problems examined in our review that we believe the FBI must address 
as it continues to change its Counterterrorism Program. Our recommendations 
flow from the analysis of the deficiencies that we found in the way the FBI 
handled information related to the September 11 attacks.*” 


275 Attached in the Appendix is the FBI’s response to this report and our 


recommendations. 
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I. Recommendations 


A. Recommendations related to the FBI’s analytical program 


Recommendation No. 1: Improve the hiring, training, and 
retention of intelligence analysts. 


As discussed in Chapter Two, the FBI acknowledged shortly after the 
September 11 attacks that its analytical program was inadequate and in need of 
improvement. Since then the FBI has made important changes to attempt to 
address this deficiency. For example, the FBI has established the Office of 
Intelligence with separate management and career tracks for analysts. In 
addition, the FBI has created an analytical branch in the Counterterrorism 
Division and has established the College of Analytical Studies at the FBI 
Academy in Quantico, Virginia, with a 6-week training program for all 
analysts. 


In addition to these important changes, the FBI must ensure that it hires, 
trains, and retains a sufficient number of skilled analysts. Hiring sufficient 
numbers of qualified analysts is a challenging task. As part of this effort, 
training for analysts must be improved. For example, we found that training 
for analysts prior to September 11 was infrequent and often did not occur until 
months after they began working in their analyst positions. While training for 
analysts has improved since September 11, the FBI needs to ensure that it 
provides comprehensive and timely training for all its analysts.*”° 


To retain analysts, the FBI must ensure that it creates an attractive career 
path for analysts, with sufficient benefits and stature within the FBI. Analysts 
should have the opportunity to receive promotions to senior positions, such as 
assistant directors or deputy assistant directors, rather than being supervised 
solely by special agents who have risen to management positions within the 
FBI. Prior to September 11, 2001, the FBI did not sufficiently value or support 
the critical work of its analysts. The FBI must ensure that it elevates the 
importance of analysts and their work within the FBI. 


276 The OIG is currently conducting an audit examining the FBI’s efforts to hire and 
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Recommendation No. 2: Ensure effective management of 
analysts. 


Our review revealed problems in the management of analysts within the 
FBI, particularly the Intelligence Operations Specialists (IOSs) in the 
International Terrorism Operations Section (ITOS) at FBI Headquarters. Our 
review revealed that supervisory special agents in FBI Headquarters failed to 
provide consistent oversight and supervision of these analysts. Part of the 
problem was that the analysts were long-time FBI Headquarters employees 
with substantive expertise in terrorism matters, while their supervisors were 
agents who often lacked analytical expertise and rotated through FBI 
Headquarters on short assignments. 


Moreover, prior to September 11, 2001, ITOS worked in crisis mode, 
with insufficient resources to respond its many tasks. Consequently, 
overwhelmed analysts had to respond to the emergency of the moment. They 
did not have sufficient time to conduct comprehensive, proactive analysis to 
assess the significance or the relationship of disparate pieces of intelligence 
information. Supervisors also allowed the analysts to make critical decisions 
independently, without requiring any supervisory consultation even on 
significant matters. 


The FBI must ensure effective management of analysts. It must identify 
the priorities for analysts and ensure that their workload is reasonable enough 
for them to adequately perform the tasks assigned to them. The FBI should 
more clearly define supervisors’ responsibilities in managing its analytical 
programs. On important decisions, including determination of the priority to 
assign analytical requests, analysts should be required to consult their 
supervisors. In addition, analysts should not be able to close leads by simply 
reassigning them, which also occurred with regard to the Phoenix EC. 


We also believe that the analysts’ supervisors must have greater 
experience and broader knowledge of the activities under their area of 
supervision. Moving supervisors rapidly through critical units dealing with 
counterterrorism undermines the management of the program and the FBI’s 
critical need for continuity and expertise in these important units. Supervisory 
positions that oversee analysts should be filled by experienced and permanent 
personnel, not analysts in acting capacities or agents who rotate through the 
units for short periods of time. 
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Recommendation No. 3: Require greater coordination and 
consultation between the operational and analytical units. 


Various FBI analysts and managers told us that, in the past, operational 
managers in the FBI frequently overruled the conclusions of analytical work 
products. Before information could be disseminated to the field, ECs 
containing the analytical information had to be approved by the operational 
unit with responsibility for the area. The witnesses stated that the job of 
operational personnel is to verify that the facts cited by analysts are correct, but 
that the expertise and judgment of analysts normally should be relied upon in 
deciding the conclusions to be drawn from those facts. 


We agree that operational personnel generally should not alter or veto the 
conclusions of an analyst in an analytical product. At the same time, analytical 
products need the input and expertise of operational personnel. The FBI 
therefore should take steps to institutionalize the operational components’ 
involvement in developing and reviewing analytical products and set up a 
process for ensuring that these products reflect the consensus of the FBI’s 
analytical and operational components. 


Because the FBI combines intelligence and law enforcement 
components, disputes inevitably will arise between the operational unit and the 
analytical unit over, among other things, whether certain information should be 
distributed to the field or should appear in a briefing document because of 
concerns that it could jeopardize a pending investigation or prosecution. We 
believe that the FBI should establish a more defined and efficient process for 
handling these types of conflicts. The process should involve discussions 
between the disagreeing components and the input of the FBI’s Office of 
General Counsel in appropriate circumstances, with a decision resting with 
upper-level FBI management. 


B. Recommendations related to the FISA process 


Recommendation No. 4: Ensure adequate training of FBI 
employees involved in the FISA process and 
counterterrorism matters. 


We found that many FBI employees who were assigned to 
counterterrorism work — whether analysts, special agents in field offices, or 
FBI Headquarters supervisory special agents — received little formal training 
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about counterterrorism matters in general or FISA in particular. Even in 
complicated matters, such as the intricacies of terrorist organizations such as al 
Qaeda, these FBI employees primarily received on-the-job training. 


We found, in particular, that FBI employees’ knowledge about FISA was 
limited and uneven. FBI Headquarters employees we interviewed generally 
were not even familiar with the 1995 Procedures. Although they were 
knowledgeable about basic steps required for obtaining a FISA warrant, they 
were not well versed in the requirements of the FISA statute, particularly when 
the facts of the case did not fit within a standard pattern. We also found that 
special agents in FBI field offices were not well informed about the FISA 
process, such as the steps needed to finalize a FISA request, or the types of 
information needed to meet the requirements for a FISA warrant. 


After the September 11 attacks, the 1995 Procedures and other 
restrictions regarding FISA and the dissemination of intelligence information 
have dramatically changed. By many accounts, the FBI and the Office of 
Intelligence and Policy Review (OIPR) are now much more aggressive in their 
approach to obtaining FISA warrants than before September 11. In addition, 
we were informed that in the spring and summer of 2003, many FISA training 
sessions were provided for FBI and OIPR employees, as well as employees 
from other Department of Justice components and intelligence agencies 
working on counterterrorism matters. This type of training, in our view, should 
be expanded and provided regularly. 


In addition, the FBI must ensure that its employees understand the 
requirements for opening intelligence and criminal investigations that relate to 
counterterrorism and the tools available to them to conduct these 
investigations. This training should include detailed information on FISA and 
how it can be used, even when the case does not fit a standard fact pattern. 


FBI agents also should receive training about the restrictions on the use 
of information acquired in intelligence investigations. Formal training should 
be provided at all levels in FBI Headquarters and for all field office employees 
who are involved with counterterrorism investigations, including the Chief 
Division Counsels (CDC) in the field. Widespread and continual training on 
FISA and other counterterrorism issues is especially important given the 
increase in the number of FBI employees who, since September 11, 2001, have 
been reassigned to counterterrorism matters from other programs. 
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Recommendation No. 5: FBI attorneys should be better 
integrated into counterterrorism investigations. 


Our review found that the FBI lacked an effective system for ensuring 
that FBI lawyers were sufficiently integrated into the FISA process or other 
legal issues arising in counterterrorism investigations. For example, the FBI 
Headquarters supervisor most involved with the Moussaoui case had to consult 
with four different National Security Law Unit (NSLU) attorneys about the 
Moussaoui FISA request because FISA requests were not assigned to a single 
NSLU attorney who was responsible for seeing it through the process. In 
addition, none of the NSLU attorneys consulted with anyone from OIPR about 
the Moussaoui FISA request, despite its unusual nature, partly because one 
NSLU attorney never was completely responsible for the matter. 


We believe that one NSLU attorney normally should be assigned to 
handle a particular FISA request or other legal matter arising in a 
counterterrorism investigation. This would ensure that an NSLU attorney is 
familiar with the facts and legal issues from beginning to end of the case, and it 
would give the attorney greater responsibility for a particular matter. In 
addition, we believe that NSLU attorneys should have more contact with field 
agents in important cases. None of the NSLU attorneys in the Moussaoui case 
spoke with the field agents, or even were provided the underlying documents 
drafted by the field agents. 


On the other hand, we found that the Minneapolis field agents in the 
Moussaoui case did not consult fully with their CDC about what was needed to 
support their FISA request, despite their frustration and disagreement with the 
advice they received from FBI Headquarters. Field agents should be 
encouraged to consult with CDCs about FISA requests or other legal issues that 
arise out of counterterrorism investigations. CDCs also should be more 
involved in the FISA process and better trained to be in a position to provide 
useful guidance to field agents and represent the field office on a particular 
FISA request. 


Recommendation No. 6: Ensure closer consultation between 
the FBI and OIPR, particularly on important or unusual 
cases. 


In the Moussaoui case, the FBI never consulted OIPR about the 
possibility of obtaining a FISA warrant, despite the strong disagreements about 
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the case between FBI Headquarters and the field office. The chief of the 
NSLU told us that he had never seen a supervisory special agent in 
Headquarters so adamant that a FISA warrant could not be obtained and at the 
same time a field office so adamant that it could. We believe that in unusual 
cases, like in the Moussaoui case where the evidence did not fit a standard fact 
pattern for FISA and strong disagreement existed within the FBI about the 
strength of the evidence, FBI lawyers should consult with OIPR about the 
issues involved in the case. OIPR is responsible for implementing FISA and is 
the Department’s expert on the requirements of the statute, and the FBI should 
discuss with it the important and contentious issues involved in such a FISA 
request. 


Since the September 11 attacks, much has changed about the 
requirements and use of FISA, including the legal framework and the way the 
Department uses the statute. We also understand that OIPR and the FBI now 
consult more closely on the use of FISAs in particular cases, as well as on the 
requirements of the statute. We recommend that this closer consultation be 
enhanced and promoted, and that the FBI be encouraged to seek assistance and 
advice from OIPR at early stages of investigations involving the use of FISA. 


C. Recommendations related to the FBI’s interactions with the 
Intelligence Community 


Recommendation No. 7: Ensure effective management of 
FBI detailees. 


Our review found that the FBI detailees to the CIA’s Counterterrorist 
Center (CTC) lacked defined responsibilities. The detailees told us they were 
not given specific instructions about their responsibilities and each detailee 
defined the job individually. As a result, they, as well as the FBI and the CIA, 
had significant misperceptions and inconsistent expectations about their roles. 
For example, the detailees did not believe they were to act as “backstops” to 
ensure that CIA information was passed to the FBI, and they did not scour CIA 
cable traffic for this purpose. Yet CIA employees believed that at least one of 
the FBI detailees had been assigned to the CTC specifically for this purpose. 


The FBI and the CIA did not have any memoranda of understanding 
describing the detailees’ functions. Moreover, the detailees were not even 
evaluated based upon what they did at the CTC. Instead, their performance 
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appraisals were based on what they did as FBI employees, not as detailees to 
the CTC. 


The FBI needs to formally describe the roles and responsibilities of 
detailees and communicate this to the detailees and to the CIA. To avoid 
misunderstandings and ensure continuity in the program, the FBI should 
document these responsibilities in a formal memorandum of understanding 
with the CIA. In addition, the performance work plan of each detailee should 
be revised to reflect the critical elements of the job being performed by the 
detailee at the CIA, and someone who oversees their daily work should 
evaluate them. 


Recommendation No. 8: Ensure FBI employees who 
interact with other intelligence agencies better understand 
their reporting processes. 


As we discussed in Chapter Five of this report on the Hazmi and Mihdhar 
matter, FBI employees we interviewed did not fully understand the CIA’s 
system for reporting intelligence information. For example, the FBI’s 
Assistant Legal Attaché (ALAT) who dealt with the source mistakenly 
believed that the CIA’s TDs he received contained all source reporting that was 
available from the CIA. In fact, other operational cables contained significant 
CIA information about the source, including that the source had identified 
Mihdhar in the Malaysian meeting photographs. We found that other 
experienced FBI agents who interacted frequently with the CIA also were 
unaware of CIA procedures and important ways to obtain additional 
intelligence information from the CIA. 


We believe that FBI employees who interact with the CIA should be 
more familiar with CIA and other intelligence agencies’ processes for reporting 
intelligence information. Even if FBI employees do not have full access to the 
reports of other intelligence agencies or the systems from which these 
intelligence reports are produced, the FBI employees should be aware of the 
processes and reporting by other intelligence agencies to avoid the 
misunderstandings that occurred in the Mihdhar matter. 


Recommendation No. 9: Provide guidance for how and 
when to document intelligence information received from 
informal briefings by other intelligence agencies. 
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The FBI lacked clear policies and procedures for how and when to 
document intelligence information received from the CIA, particularly 
intelligence communicated in an informal manner. For example, FBI 
employees received verbal briefings on Mihdhar from CIA employees in the 
FBI’s Strategic Information Operations Center (SIOC) around the time of the 
Millennium threat. One of the reasons the SIOC was activated during this 
period was to obtain and coordinate the response to threat information from 
various sources. Yet, the information the FBI received about Mihdhar in the 
SIOC was never documented in a way that was accessible to other FBI 
employees. 


We are not suggesting that every informal communication from the CIA 
to the FBI must be documented. However, the FBI should establish better 
guidance for its employees as to how and when such information from such 
informal briefings should be documented. 


Recommendation No. 10: Ensure that the FBI’s information 
technology systems allow FBI employees to more readily 
receive, use, and disseminate highly classified information. 


The FBI has acknowledged for several years that its information 
technology systems are not adequate. The FBI is in the process of 
implementing widespread changes to its systems, and the upgrading of its 
information technology systems is one of the highest priorities of the FBI. The 
OIG and others have monitored and reported extensively on the progress of the 
upgrade to the FBI’s systems, particularly the FBI’s Trilogy project.” 


In this review, we found many examples of how the FBI’s poor 
information technology systems hindered the handling and use of intelligence 
information. For example, most of the persons listed on the attention line of 
the Phoenix EC never saw it. Unless a lead is “set” for a specific person in the 


277 The Trilogy project is the largest FBI information technology project, and has been 


recognized as essential to upgrading the FBI’s archaic and inadequate computer systems. 
Trilogy’s three main components involve upgrading the FBI’s hardware and software; 
upgrading the FBI’s communications networks; and upgrading the FBI’s most important 
investigative applications, including its Automated Case Support (ACS) system and the 
introduction of the Virtual Case File system. 
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FBI’s ACS system, the system does not notify the person that a document is 
addressed to them. While it was possible for the addressees to access the 
document in ACS by searching for documents containing their names, the 
system was so cumbersome that FBI employees usually did not do this. 


As the FBI moves forward in upgrading its information technology 
systems, it must ensure that it is able to disseminate electronically throughout 
the FBI intelligence information, regardless of the classification level. Agents 
and analysts at FBI Headquarters and in the field should be able to access 
intelligence information readily to enable them to adequately perform their 
jobs. They should also be able to communicate electronically with their 
counterparts at other intelligence agencies. The FBI’s upgrade of information 
technology must take into account the needs for access and use of highly 
classified information. 


Recommendation No. 11: Ensure appropriate physical 
infrastructure in FBI field offices to handle highly classified 
information. 


In our review, we found that the FBI’s field offices generally lacked the 
necessary physical infrastructure to readily use highly classified intelligence 
information from the CIA and NSA. For example, the workspaces in the FBI’s 
New York and San Diego Field Offices did not permit FBI personnel to handle 
SCI information at their desks. In addition, the FBI’s sensitive compartmented 
information facilities (SCIFs) in those offices were not large enough or 
adequate enough to permit agents to regularly access or handle highly 
classified information. In addition, many field agents did not have sufficient 
access to secure telephones. For example, in the New York Field Office, the 
office most responsible for counterterrorism investigations before the 
September 11 attacks, an entire squad with as many as 25 individuals shared 
one secure phone. In order to successfully carry out its counterterrorism 
functions, the FBI must provide its personnel with adequate infrastructure to 
handle highly classified information. 


Recommendation No. 12: Improve dissemination of threat 
information. 


Prior to September 11, 2001, the FBI provided little guidance to its 
employees about what information constituted a “threat” and what threat 
information should be disseminated in the FBI, to the Intelligence Community, 
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or more widely. FBI employees told us that it was left to the judgment of the 
supervisory special agent or analyst in FBI Headquarters to decide what 
constituted threat information and what should be disseminated. For example, 
in the Moussaoui case the Minneapolis special agent drafted a detailed 
memorandum providing the facts of the Moussaoui case and an assessment of 
the threat the agent believed Moussaoui posed, including that his actions were 
“consistent with facilitating the violent takeover of a commercial aircraft.” 
One of the purposes of the memorandum was to ensure that other agencies, 
such as the Federal Aviation Administration, were made aware of concerns 
about Moussaoui. However, the FBI Headquarters supervisory special agent 
who prepared a teletype to the Intelligence Community about Moussaoui did 
not include any assessment of whether he posed a threat, and the teletype 
omitted significant facts about the Moussaoui case. The teletype was not 
distributed to all FBI field offices or even to all Intelligence Community 
agencies. 


We recognize that threat assessments require judgments, and not every 
piece of information suggesting some kind of harm should be disseminated 
throughout the FBI and the Intelligence Community. By necessity, FBI 
employees must exercise discretion in evaluating potential threat information. 
However, we believe the FBI should issue clear guidance for evaluating what 
type of threat information should be disseminated, within and outside the FBI, 
and how it should be disseminated. 


D. Other recommendations 


Recommendation No. 13: Evaluate the effectiveness of the 
rapid rotation of supervisory special agents through the FBI 
Headquarters’ Counterterrorism Program. 


Many FBI supervisory special agents rotate through important FBI 
Headquarters supervisory positions for a short time, often two years or less. 
Because of the rapid turnover, the supervisory positions can remain unfilled for 
months at a time. We believe this turnover of managers in the FBI 
Counterterrorism Program can harm the operation and management of the 
program. For example, we found that analysts, often long-time FBI 
Headquarters employees, were more knowledgeable than their supervisors 
about the operation of the unit and the substantive subject matter. Brief stints 
at FBI Headquarters can make it difficult for managers to become fully 
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conversant with the subject matter and procedures in the Counterterrorism 
Program at FBI Headquarters before they are sent to a new assignment. 


Part of the job of a manager is to understand the context with respect to a 
particular terrorist organization or part of the world, and to use this knowledge 
when advising field offices about their various investigations. The rotation of 
special agents through supervisory positions in FBI Headquarters is so frequent 
and rapid that managers often do not have the time, ability, or incentive to 
acquire the expert knowledge related to their functions. As a result, we believe 
the FBI should evaluate the effectiveness of rotating supervisory special agents 
and unit chiefs so rapidly through FBI Headquarters. 


Recommendation No. 14: Provide guidance on the type of 
information that agents should obtain for evaluating assets 
and for documenting the yearly check on assets. 


In assessing the FBI’s handling of an asset in San Diego with whom 
Hazmi and Mihdhar lived in 2000, we determined that the FBI control agent 
who handled the asset did not inquire about the individuals who the asset said 
was living with him. The asset told the control agent that two young men who 
recently came to the United States had moved in with him as boarders but the 
FBI agent did not obtain any additional information about the boarders, other 
than their first names. Had the control agent pursued information about the 
asset’s boarders, he might have learned about the CIA information regarding 
Hazmi and Mihdhar and documented their presence in the United States. 


We found little FBI guidance about what information the control agent 
should have obtained from an asset in circumstances such as this. We also 
found no consensus among the FBI agents we interviewed as to whether they 
would have requested additional information from an asset in these 
circumstances. 


The FBI’s policy at the time was that the FBI agent was required to 
“continually address” the asset’s “bona fides” and provide a yearly evaluation 
report to FBI Headquarters. However, the policy did not specify how to assess 
the bona fides of the asset or what information should be contained in the 
yearly evaluation. The control agent’s report on the San Diego asset used the 
same boilerplate language each year, with no substantive information provided 
about the asset or the checks done on the asset. 
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We believe the FBI should evaluate its policies regarding evaluation of 
assets and determine if agents are collecting and documenting sufficient 
information about its assets. For example, the FBI should consider the 
circumstances when FBI employees should seek information about persons 
living with or otherwise closely associating with an FBI asset. In addition, the 
FBI should consider detailing the minimum information an asset file must 
contain to verify that an adequate background check has been conducted. This 
information is necessary to allow the FBI to determine whether the control 
agent is continuing to assess each informational asset’s credibility, as required. 
Moreover, information from an asset is only accessible and useful if 
documented. The FBI should evaluate its asset policies and consider what 
information it should require control agents to obtain and document about 
assets. 


Recommendation No. 15: Improve the flow of intelligence 
information within the FBI and the dissemination of 
intelligence information to other intelligence agencies. 


Prior to the September 11 attacks, sharing of intelligence information 
within and outside the FBI was piecemeal and ad hoc rather than systematic. 
The FBI’s normal process for disseminating intelligence information was to 
route it primarily to analysts, who then used their judgment and experience to 
decide what needed to be disseminated further, and to whom. However, the 
analysts were overwhelmed and had to address crises and emergencies as they 
arose, with little time to conduct systemic evaluations or carefully consider 
what information should be provided throughout the FBI. As a result, 
information that did not demand immediate attention, such as the Phoenix EC, 
was not addressed thoroughly or timely. 


Moreover, the FBI lacked clear priorities or requirements for the 
dissemination of information once it was collected. There was little guidance 
regarding the types of information that had to be disseminated or included in 
reports to other intelligence agencies. In addition, FBI procedures for 
disseminating intelligence information were cumbersome, requiring many 
levels of review just to distribute information, even within the FBI. 
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Since September 11, the FBI has made significant changes as to how 
intelligence is routed and shared, both within and outside the FBI, and we have 
not examined in detail each of these changes.’ But the FBI’s evolution is a 
difficult and ongoing process. We believe that, as part of this process, the FBI 
should continue to examine its policies to ensure that it has clear guidance for 
its employees to identify what kind of intelligence information must be shared 
and how it must be shared, both within and outside the FBI. 


Recommendation No. 16: Ensure that field offices allocate 
resources consistent with FBI priorities. 


In 1998, the FBI elevated counterterrorism to a top agency priority. 
However, the FBI failed to ensure that resources in field offices were 
redirected to counterterrorism to reflect this change in priority. For example, in 
our review of the Hazmi and Mihdhar matter, we found that the San Diego 
Field Office did not shift its resources in response to changed priorities. As a 
result, the San Diego Field Office focused little attention on counterterrorism in 
general and al Qaeda in particular. The relatively low priority the San Diego 
FBI gave to the Counterterrorism Program was not atypical of FBI field offices 
before September 11. 


After September 11, the FBI refocused its traditional crime-fighting 
orientation and placed its highest priority on terrorism prevention, dramatically 
shifting resources to the Counterterrorism Program. We believe the FBI must 
ensure that it systematically evaluates the allocation of resources by field 
offices to ensure that each field office directs its resources in accord with the 
FBI’s priorities.*” 


II. Conclusions 


Our review found significant deficiencies in the FBI’s handling of 
intelligence information relating to the September 11 attacks. Shortly after the 


*78 For example, see the OIG report entitled “The Federal Bureau of Investigation’s 


Efforts to Improve the Sharing of Intelligence and Other Information” (December 2003). 


279 For an evaluation of the changes that the FBI has made in the allocation of its 


investigation resources, see the OIG report entitled “Federal Bureau of Investigation 
Casework and Human Resource Allocation” (September 2003). 
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attacks, the FBI indicated that it did not have any information warning of the 
attacks. However, information was soon discovered that had been in the 
possession of the FBI and the Intelligence Community before September 11 
that related to the hijacking of airplanes by extremists or that involved the 
terrorists who committed the September 11 attacks. 


At the request of the FBI Director, we examined what the FBI knew 
before September 11 that was potentially related to the terrorist attacks. We 
focused on the FBI’s handling of the Phoenix EC, the Moussaoui case, and the 
information about Hazmi and Mihdhar, two of the September 11 terrorists. 


Our review found that the FBI had failed to fully evaluate, investigate, 
exploit, and disseminate information related to the Phoenix EC, the Moussaoui 
case, and the Hazmi and Mihdhar matter. The causes for these failures were 
widespread and varied, ranging from poor individual performance to more 
substantial systemic deficiencies that undermined the FBI’s efforts to detect 
and prevent terrorism. 


By describing the action and inaction of individual FBI employees in this 
report, particularly the lower-level employees whose conduct we discuss in 
detail, we do not suggest that they committed intentional misconduct. Nor do 
we think that they are responsible individually for the FBI’s deficiencies in 
handling the information related to the September 11 attacks. We believe it 
would be unfair to blame these individuals, who often worked with insufficient 
resources and with overwhelming impediments. Many pursued their duties in 
good faith, making difficult judgments about where to focus their efforts. 
Some performed aggressively and well. Others did not do all they could have 
and should have to respond to the information they received. While the FBI 
should examine the performance of the individuals who we describe in this 
report, we do not believe they are personally responsible for not preventing the 
attacks or should be blamed for the tragedy that occurred. 


Rather, we believe that widespread and long-standing deficiencies in the 
FBI’s operations and Counterterrorism Program caused the problems we 
described in this report. For example, the FBI did not handle the Phoenix EC 
appropriately or give it the attention it deserved. The FBI did little with the 
Phoenix EC before the September 11 attacks because of the FBI’s inadequate 
analytical program, insufficient supervision of analysts in the program, the 
focus on operational priorities at the expense of strategic analysis, the failure to 
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adequately share intelligence information, and the lack of adequate tools to 
facilitate information sharing within and outside the FBI. 


With regard to the Moussaoui case, the Minneapolis FBI agents deserve 
credit for their tenacity and instincts regarding Moussaoui’s suspicious actions. 
These agents did not receive adequate support, either from field office 
managers or from FBI Headquarters. Although it is not clear that even if the 
FBI had pursued the case more aggressively it would have succeeded in 
obtaining a warrant to search Moussaoui’s possessions before the September 
11 attacks, the handling of this case illustrated systemic deficiencies in how the 
FBI handled intelligence cases. These deficiencies included a narrow and 
conservative interpretation of FISA, inadequate analysis of whether to proceed 
as a criminal or intelligence investigation, adversarial relations between the 
field and FBI Headquarters, and a disjointed and inadequate review of potential 
FISA requests by FBI attorneys. 


With regard to Hazmi and Mihdhar, the FBI had at least five 
opportunities to uncover information that could have informed the FBI about 
these two terrorists’ presence in the United States and led the FBI to seek to 
find them before September 11, 2001. But the FBI did not uncover this 
information until shortly before the September 11 attacks. The FBI’s 
investigation then was conducted without much urgency or priority, and the 
FBI failed to locate Hazmi and Mihdhar before they participated in the attacks. 
Our examination of the five lost opportunities found significant systemic 
problems with information sharing between the CIA and the FBI, and systemic 
problems within the FBI related to its Counterterrorism Program. These 
problems included inadequate oversight and guidance provided to FBI 
detailees at the CIA, FBI employees’ lack of understanding of CIA procedures, 
inconsistent documentation of intelligence information received informally by 
the FBI, the lack of priority given to counterterrorism investigations by the FBI 
before September 11, and the impact of the “wall” between criminal and 
intelligence investigations. 


In evaluating the FBI’s actions in the three matters examined in this 
report, we cannot say whether the FBI would have prevented the attacks had 
they handled these matters differently. Such a judgment would be speculative 
and beyond the scope of our inquiry. But while we cannot say what would 
have happened had the FBI handled the information differently or if the FBI 
had pursued these investigations more aggressively, the way the FBI handled 
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these matters was a significant failure that hindered the FBI’ S chances of bemig 
able to detect and prevent the September 11 attacks. 


In this chapter, we make 16 recommendations to the FBI to sauces the 
problems we found in our review. In providing these recommendations, we 
recognize that the FBI has made significant changes since the September 11 
attacks, and it is already addressing many of the matters that we describe in this 
report. But we believe that the FBI should know exactly what happened with 
regard to the Phoenix EC, the Moussaoui case, and the Hazmi and Mihdhar 
matter to ensure that it fully addresses the systemic failures we found in these 
matters. We believe that our detailed descriptions of the FBI’s actions, 
together with our recommendations, can help the FBI improve its _ 
counterterrorism operations as it transforms itself to better address the threat of 


terrorism. 
GF S 
fore 


Glenn A. Fine 
Inspector General 
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ACS — Automated Case Support System 
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AG Guidelines — Attorney General Guidelines 
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AUSA — Assistant United States Attorney 
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CIA — Central Intelligence Agency 

CIR — Central Intelligence Report (CLA) 
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CTC — Counter Terrorist Center (CLA) 
CTD — Counterterrorism Division (FBI) 


DCI — Director of Central Intelligence 
DEA — Drug Enforcement Administration 
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FFI — Full Field Investigation 

FISA — Foreign Intelligence Surveillance Act 
FISC — Foreign Intelligence Surveillance Court 
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IA — Integrated Intelligence Information Application 
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IOS — Intelligence Operations Specialist 

IRS — Intelligence Research Specialist 
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ITOS — International Terrorism Operations Section 


JIC] -Joint Intelligence Committee Inquiry 
JTTF - Joint Terrorism Task Force 
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NSA — National Security Agency 

NDPO - National Domestic Preparedness Office 
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NFIP — National Foreign Intelligence Program 
NSD — National Security Division 

NSL — National Security Letter 

NSLU — National Security Law Unit 


OGC — Office of General Counsel 
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OIPR — Office of Intelligence Policy and Review 
OLC — Office of Legal Counsel 

OPR — Office of Professional Responsibility 
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PI - Preliminary Inquiry 
RFU — Radical Fundamentalist Unit 


SAC — Special Agent in Charge 

SCI — Sensitive compartmented information 

SCIF — Sensitive Compartmented Information Facility 
SDNY — Southern District of New York 

SIOC — Strategic Information & Operations Center 
SSA — Supervisory Special Agent 

STU III — Secure Telephone Unit third generation 


TAOG — Threat Assessment Operations Group 
TD — Telegraphic Dissemination (CTA) 


TECS — Treasury Enforcement Communication System 


UBL — Usama Bin Laden 

UBLU - Usama Bin Laden Unit 

USAO — United States Attorney’s Office 
USIC - U.S. Intelligence Community 
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ey Bret five chapters an the rocommnendations of the s 
subject share orgeat for whether anything in the 


recommendations inaccurate or unwarranted. This document 
is the FBI's a se to the factual inaccuracies which is attached and the report's 
_ recommendations. 


Office of the General's i as a comprehensive i assessment of our 
operations and as a of ifying weaknesses that corrective action to 
strengthen our That is why the Director sted your office to conduct this 


oversight entities. I am pleased to inform you that the FBI has made significant 
not Y on the recommendations proffered in your eport but on al he ae covered 
by our own internal assessments. 

Before responding to the individual recommendations, the OIG and the 
American public need to be made aware of the progress made by the Federal Bureau of 
Investigation (FBI) since the horrific attacks of September 11,2001. If we only 
responded to the recommendations in the report, readers would have an incomplete _ 
picture of the progrees we have made and perhaps have a difficult time piecing together 


the information under sixteen different recommendations. Director Mueller has 


counterterrorism operations, expanded ilities, 
business practices and technology, and improved coordination with our partners. (U) 


Director Mueller replaced a priority system which allowed supervisors a great 
eal ef flexibility with a sat of 10 pripeities tat etrlotly govern the ellosetion of parcasi 
and resources in every FBI program and field office, Counterterrorism is now the 
overriding priority, and every terrorism lead is addressed, even if it requires a diversion 
of resources from other priority areas. (U) 


To implement these new priorities, we increased the number of Special Agents 
assigned to terrorism matters and hired additional intelligence analysts and translators. 
We also established a number of operational units and entities that provide new or 
improved to address the terrorist threat. These include the 24/7 
Counterterrorism Watch (CT Watch) and the National Joint Terrorism Task Force 


Force (FTTTF) to help identify terrorists end keep them out of the United States: the 
Terrorism Reports and Requirements Section to dissaminate FBI terrorism-related 
intelligence to the Intelligence Community; and.the Counterterrorism Analysis Section to 
“connect the dots” and assess the indicators of terrorist activity against the U.S. from a 
strategic perspective. (U) 


We centralized management of our Counterterrorism Program at Headquarters to 
priorities 


\yze, edhe ag 
USA PATRIOT Act, related Attorney General Guidelines, and the ensuing opinion by the 
Foreign Intelligence Surveillance Court of Review removed the barrier to sharing 
information between intelligence and criminal investigations, we quickly implemented a 
plan to integrate all our capabilities to better prevent terrorist attacks, Director Mueller 
elevated intelligence to program-level status, putting in place a formal structure and 
concepts of operations to govern FBI-wide intelligence functions, and establishing Field 
‘Intelligence Groups (FIGs) in every field office. (U) 


(EM a 


have enhanced the level of coordination end information sharing with state and municip 
law enforcement personnel. We expanded the number of Joint Terrorism Task Forces 

(JTTFs), increased technological connectivity with our partners, and implemented new 

ways of sharing information through vehicles such as the FBI Intelligence Bulletin, the 
Alert System, and the Terrorist Screening Center. To improve coordination with other 

federal agencies and members of the Intelligence Community, we joined with our federal 
partners to establish the Terrorist Threat Integration Center, exchanged 

instituted joint briefings, and started using secure networks to share information. We also 


a beam eed riksuiel Louke outs I AE crear naa tees 
expansion begun under Director Louis Freeh; by offering investigative and forensic 


private businesses involved in critical infrastructure and finance, w) 


fil twig aia hl egies aa aa 
to streamline our business processes and to improve our ability to search for and analyze 
information, draw connections, and share it both inside the Bureau and out. We have 


terrorist information in a searchable central database. We developed, and are 
pearing ona ho Viral Case Fe management te that will revolutionize 
hew the FBI does business. (U) 


AAE BE ONE ER ye 
réfponsive to operational needs. We revised our approach to strategic planning, and we 
refocused our recruiting and hiring to attract individuals with skills critical to our i 
counterterrorism and intelligence missions. We have developed a more comprehensive 
training program and instituted new leadership initiatives to keep our workforce flexible. 
We are modemizing the storage and management of FBI records. We also built, and 
continue to improve, an extensive security program with centralized leadership, 
Lc: ee 
education and training. (UU) 


Pas Cer fe er a We 


Prior to September 11, 2001, the Bureau had no centralized structure for the 
national management of its Counterterrorism Program, and terrorism cases were routinely 
managed out of individual field offices. An al-Qa'ida case, for example, mighthavebeen . 
run out of the New York Field Office; a HAMAS case might have been managed by the 
Washington Field Office, This arrangement functioned for years, and produced a number 
of impressive prosecutions. Once counterterroriem became our overriding priority, 
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In December 2001 “(i Diiealor raoid eid. aaia tin Gaii 


ribana ard ina eth pion of Reena Ania Diosstor (BAD) St 


costiiuade comabiebicrilian oparitan iid hateilgunns pancieeticn darnsstiolll and 
overseas; to conduct Haison with other agencies and governments; and to establish clear 
lines of accountability for the overall development and success of our Counterterrorism 
Program, With this management structure in place, we are driving the fundamental 
changes that are necessary to accomplish our counterterrorism mission. (U) 


We divided the operations of the Counterterrorism Division into branches, 


sections, and units, each of which focuses ona different agpoct of the ourent terrorism 


The Bureau is designed, and has always operated, as a law enforcement and an 
intelligence agency. It has the dual mission: 1) to e a 
completed crimes (the law enforcement mission) and 2) collect intelligence that will. 
he proven fave (rims ond ast poliny onion a cs doce: making Cle 
intelligencs mission). History has shown that we are most effective in in protecting the U.S. 
SHE TER ORE ene Cer rt eee Fs ree, UD 


beyond arrest and prosecution. Starting with the Ku Klux Klan oases în the 1960s and the 
Mafia cases of the 1970's, our agents began to view criminal investigations not only as 
means of arresting and prosecuting someone for a completed crime, but also as a means 

of obtaining information to prevent future crime. The goal was not simply to arrest 
individual members of the Klan or the Mafia, but to penetrate and dismantle the whole 


n nis cate dd luca rie Garena G 
predicting and preventing criminal activity. We also learned to te think strategically before 


making arrests, sometimes opting to delay a suspect's arrest to » allow more opportunity for 
surveillance that might disclose other conspirators or other criminal plang. We have used 
his ppoech w great tect in organized rine cts and eyongeinvetigtons snd 
members of our Safe Streets Task Forces use it in their fight against street gangs. (U) 


Tits i Siegel, Sia seed open anlan Prior to September 
Lith, however, we were handicapped in our ability to implement this approach in the 
aAa AE tee banc iets NAS (I 


such as S KAID MAUNE AA ARDIE = Pime E pae Pa 
intelligence mission of protecting the U.S. against attack or other harm by foreign entities. 
They are criminal investigations since international terrorism against the U.S. constitutes 
a violation of the federal criminal code. (U) l 

- Over the past two decades, a regime of court rules and internal DOJ procedures 

; ; deicdoped surrounding the uss of FISA warrants that barred FEI agents and other 

Intelligence Community personnel working intelligence cases that employed the FISA 
tool from coordinating and swapping leads with agents working criminal cases. As a 
result of this legal “wall,” “intelligence” agents and “criminal” agents working on a 
terrorist target had to proceed without knowing what the other may have been doing 
about that same target. In short, we were fighting intemational terrorism with one arm 


tied behind our back. (U) 


The USA PATRIOT Act, enacted on October 26, 2001 eliminated this “wall” 
and suthorized coordination among agents working criminal matters and those working 
See mete tien tae abit, 
Intelligence Sharing Procedures for Foreign Intelligence and Foreign Counterintelligence 
Investigations Conducted by the FBI (Intelligence Sharing Procedures) to capitalize on 
thls lngichadtve aiaga, The haw padara spacklicdiy weliceian’ agucta eosin 
intelligence cases to disseminate to criminal prosecutors and investigators all relevant 


On November 18, 2002 the Foreign Intelligence Surveillance Court of Review 


Ea loot I vern, (U) 


officially 
can employ intelligence tools as well as criminal ptocesses and procedures, In Jaly 200, 
we formalized this approach in our Model Counterterrorism Investigative Strategy 
(MCTS), which was issued to all field offices and has been the subject of extensive field 
training. (U) -i 


bai pan papa ontop nio iaa ter to pE i 


foiled terrorist-related operations and disrupted cells frora Sexttio, Washington, to Detroit, 
sid 2 cialis i i 


Although we are now able to coordinate our intelligence collection and 
criminal law enforcement operations, we can only realize our full potential as a 
terrorism prevention agency by developing the intelligence structure, capabilities, and 
po E treba seria Gace O 
cannot expect to defeat a sophisticated and opportunistic adversary like al-Qa'ida. (U) 

For a variety of historical reasons; the Burean had not developed this intelligence 
capacity prior to September 11. While the FBI has always been one of the world's best 

lished 


the evidence in their particular cases, and then used that analysis to guide their 
investigations. The FBI as an institution, however, had not élevated that analytical 
process above the individual case or investigation to an overall effort to analyze 


intelligence and strategically direct intelligence collection against threets aoross all 


programa. (U) 

The attacks o of September 11, 2001 highlighted the noed to develop an 
intelligence procesa for the Counterterrorism Program and the rest of the Bureau. Since 
then, we have undertaken to build the capacity to fuse, analyze, and disseminate our 


terrorism-related intelligence, and to direct investigative activities based on our analysis 
of gaps in our co orrai a e mae 
proceeded in four stages. (U) 


PR ich ang dish tee gsteenlcomc , We temporarily reassigned analysts 
from the Criminal Investigative Division and Counterintelligence Division to various 
rr ran ence ds Sree a at." pl SE 
to assist our counterterrorism efforts. Many of these analysts provided tactical 
intilgan uly ote rove og "Hig pte ean. Alo ten worni 
exceptionally hard and helped us analyze the mass of data generated in the aftermath of 
the terrorist attacks, These deployments were a temporary measure, but the progress 
ee ee down 


College of Analytical Studies to as chs end device tu wea cada f analysts, (U) 
On December 3, 2001, the Director established the Office o f Intelligence (O 


= ie 


Ol out of he Counteersrim Dion acoso sa slone Of hendad by on 
the B Aeshi in Aala D. 


—to 
pontine oat cr ad anerging mal sy aad inl ey: 
enterprise-wide intelligence policies and capab bilities; ‘m3 ee 


to-day work o; EYEE fsa maton one OTEA ie war to the 
development of FBI-wide strategies, (U) 


Now that the Intelligence Program is a E j 


ou pre ine US 
intelligence communities, More than any other type of enforcement mission, 
counterterrorism require the participation of every level of local, state, national, and 


international government. A good example is the case of the Lacicawanns terrorist cell 


© 


To ensure a coordiriated, enterprise-wide approach, the Director recently 
designated the BAD-F to serve as the principal FBI official for information and 
intelligence sharing policy. In this capacity, the RAD-I fimctione as an advisor to the 
Director and provides policy direction on information and intelligence sharing within and 
foreign governments, (U) 


On February 11, 2004 the Attorney General announced the creation of the DOJ 
Intelligence Coordinating Council. The Council is comprised of the heads of DOJ 
agencies with intelligence responsibilities, and is currently chaired by the FBI's EAD-1. 
The Council will work to aoa kiiin sharing wiis DUT ceil o anaes at 
DOJ mest inteli enoo noede of oe comer ud arts in anode with 
intelligence priorities. It will also identify common challenges (such as electronic 
connectivity, collaborative analytic tools, and intelligence skills training) and establish 


policies and programs to address them. (U) 


Beyond these information sharing initiatives, sin iti naan es AN ER 
coordination with our state, federal, and intemnstional partners oa a number of fronts. (U) 


THM éj 


We have eatblibad much stronger working relationshipà wth th CA and ; 


. The Tarrorist Threat Integration Center is a good example o negate 
relationship with the CIA and other federal partners. Established on May 1 , 2003 at the 
direction of President Bush, TTIC coorcinstes strategic analysis o: of threats based on 
intelligence from the FBI, CIA, DHS, and DOD Raceline: bec con: feee 


analysis developed by FBI analysts detailed to TTIC, FBI analysts at Headquarters 


=> tegalarly contribute articles to the President's Terrorist Threat Report. (U) 


. The FBI currently has Agents and Analysts detailed to CIA entities, including 
the CIA's Counter Terrorism Center (CTC). We also heve FBI agents and intelligence 


ait, analysts detailed to the NSA, the National Security Council, DIA, the Defense Logistics 
ay 5 a a ma e Regional Commands, the Department of Energy, end other federal and 


Soe ee in key positions throughout the Bureau. The 


Investigative Teclanologics Division and a Section Chief in that division is on rotation 
BASARA 


-This exchange of personnel is taking place in out field offices as well. In 33 field 
locations, the CIA has officers co-located with FBI agents at ITTF si coma eh 


FBI Headquarters, the Washington Field Office, the N cw York Field Office, and the. 
Baltimore Field Office. (U) 


Each morning, in addition to FBI Briefs, the Director is briefed by a CLA briefer. 
The Director of Central Intelligence and the FBI I Director then jointly brief the President 


on current terrorism threats. In addition, CLA and DHS personnel attend the Director's 
internal terroriam briefings every weekday morning and afternoon. (U) 


The FBI is now using secure systema to disseminate classified intelligence 
reports and analytical products to the Intelligence Community and other federal agencies. 
The FBI hosts a web site on the Top-Secret Intelink/ Joint World-Wide Intelligence 
‘Community System (7WICS), a fally-encrypted system that connects more than 100 
Department of Defense, CLA, and other Intelligence Community sites. Wo also host a 
web site on SIPRNET, a similar system used by DOD for sharing information classified 
at the Secret level. In addition, à new TS/SCI network known aa “SCION” is being 
piloted in several field offices, SCION will connect FB Headquarters and field offices to 
the CLA and other members of the Intelligence Community, Seer ee 
opportunities for inter-agency collaboration. (U) 


Improving the compatibility of information technology systems Eavan e 


affected-our decisions on several key technology upgrades, (U) 
To facilitate further coordination, the FBI CIO aita on tho 


clo.(U) 
EE E STRAE ATT r 
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information sharing between our agencies that are vital to the success of our missions. 
The FBI and DHS share database access at TTIC, in the National JTTF at FBI 
Headquarters, in the FTTTF and the TSC, and in local JT TFs in our field offices around 
the country. We worked closely together to get the new Tetrorist Screening Center up 

and running. We hold weekly briefings in which our CTD analysts brief their DHS 
counterparts on current terrorism developments. We coordinate all FBI warmings with 
DHS, and we now coordinate joint warnings through the Homeland Security Advisory 
System to address our custormers’ ccncems about multiple and duplicative wamings. We 
designated an executive from the Transportation Security Administration to 
run the TSC and detailed a senior DHS executive to the FBI's Office of Intelligence to 
ensure coordination and transparency between the agencies. (U) 


On March 4, 2003, the Attomey General, the Seonstary of Homeland Security, 
and the Director of Centre! Intelligence signed a comprehensive Memorandum of 
e ng aeaaea | ope opr for information sharing, 
handling, and we. Pursuant to that MOU, information related to terrorist threats and 
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vulnerabilities is provided to DHS automatically without DHS having to request if. 


. Consistent with the protection of sensitive sources and methods and the protection of 


privacy rights, we now share as a rule, and withhold by exception. (U} 


With terrorists traveling, communicating, and planning attacks all around the 
world, coordination with our foreign partners has become more critical than ever before. 
We have steadily increased our overseas presence and now routinely deploy agents and 
crime scene experts to assist in the investigation of oversens attacks, such as the May 
2003 bombings in Sandi Arabia and Morocco, As of January 7, 2004, 413 FBI personnel 
were assigned overseas, over 200 of whom are permmently assigned. Their efforte, and 
the relationshipa that prow from them, have played a critical role in the successful 
intemational operations we have conducted over the past 31 months. (U) 


Bureau personnel have participated in numerous investigations of terrorist 
attacks in foreign countries over the past 33 months. Our approach to those investigations 
differs from the approach we traditionally have taken. Prior to September 11th, our 
overseas investi gations primarily were focused on building cases for prosecution in the 
U.S. Today, our focus has broadened to provide our foreign partners with investigative, 
forensic, and other types of support which enhance our joint efforts to prevent and disrupt 
terrorist attacks. Our partners have embraced this approach, and it is paying dividends 
with greater reciprocal cooperation and more effective joint investigations. (LJ) 


is capability requires easily 
accessible and usable by all personnel while protecting amabe rs 
(U) 


Prior to September 11th, the Bureau's information technology was inadequate to 


System. Insufficient attention was paid, howover, to technology related to the more 
fundamental tasks of records creation, maintenance, dissemination, and retrieval. In 2001, 
many employees still used vintage 1987 386 desktop computers. Some resident agencies 
could only access data in their field office via a slow dial-up connection. Many Bureau 
interoperate with systema in other programs or other parts of the Bureau, (U) 


The FBI also had a deficient information management system. The FBI's legacy 
investigative information system, the Automated Case Support (ACS), was not very 
effective in identifying information or supporting investigations. Usera navigated with the 
function keys instead of the “point and click” method common to web-based applications. 
Simple tasks, such as.storing an electronic version of a document, required a user to 
perform 12 seperate functions in a "green screen" environment. Also, the system lacked 
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agencies such as DHS Tha IDW peovides-phyniral doenge the date and atlowe woees t 
access that data without needing to know its physical location or format. Tho data in the 
IDW is at the Secret level, and the addition of TS/SCI level data is in the planning stages. 
(U) , 


Later this year, we plan to enhance the IDW by adding additional data sources, 
such as Suspicious Activity Reports, and by making it easier to search. When the IDW is 
complete, agents and analysts using new analytical tools will be able to search rapidly for 
pictures of known terrorists and match or compare the pictures with other individuals in 
minutes rather than days, They will be able to extract subjects’ addresses, phone numbers, 
and other data in seconds, rather than searching for it manually. They will have the ability 
ey ee ee ee ee ee a 
of international terrorism-related documents in seconds. (UY) - 


Ultimately, we plan to tum the IDW into a Master Data Warehouse (MDW) that 
will include the administrative data required by the FBI to manage its internal business 
pans ea aimee tapcterions cophienes cain E eventually provide 
physical data storage for, and become the system of for, all FBI electronic files. (U) 


We are introducing advanced analytical tools to help us make the most of the 


` data stored in the IDW. These tools allow FBI agents and analysts to look across multiple 


cases and multiple data sources to identify relationships and other pieces of information 
that were not readily available using older FBI systems. ‘These tools 1) make database 


sharing information inside and outside the Bureau. (U) 


While there is still much to be done, these efforts are starting to deliver the 
technology we need to stay ahead of evolving threats, Upgrading our technology will 
remain an FBI priority for the foreseeable future, and our new IT management will 
ensure that we continue to improve our systems. (U) 


With the recent directives implementing the intelligence agent career track and 
the administrative reforms related to building an intelligence workforce, we have in place 
the essential stroctural elements of an intelligence-driven counterterrorism operation. The 
challenge now is to refine and continue to develop that operation — an effort that will 
require additional resources, continued attention by FBI leadership, and constant training 
of FBI personnel in intelligence processes and objectives. (U) i 
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While wo have clearly made substantial progress over the past 33 months, it ip 
difficult to come up with an exact measurement of the current effectivences of our 
counterterrorism efforts. Besides citing the absence of successful attacks on the homeland 
ers assassins goede cape ea 
we have made. There are several yardsticks, however, that demonstrate the effectiveness 
of tas coro fanctions of a Counterterroriem Program. These yeedsticks inchada the 


PPOR Ean ovo 
hio of ase aaa e we eve neblewed sass 
September 11, 2001. (U) 


The FBI has long recognized that human source information is one of the most 
important ways to investigate criminal activity. We have long-standing expertise in - 
recruiting and using human sources, and we have used those skills to great effect across a 


iia ee cde ein eee z about 
al-Qa'ida both in the U.S. and abroad. With the U.S. TEPENE A EE T AE 
assets who were able to penetrate and report on al-Qa'ida's plans, we were vulnerable to 
surprizo attack. (U) 


, The Bure has placed a priority on developing human intelligence sources 


increase in the number of human intelligence sources in the Counterterrorism Program. 
Between August 30, 2001, and September 30, 2003, the number of sources related to 
intemational terrorism increased by more than 60 percent, and the number of sources 
related to dountetio terrorita incenesed by mines tay 39 parent. (U) 


FISA coverage has also increased significantly, reflecting both our increased 
focus on counterterroriam and counterintelligence investigations and improvement in the 
operation of the FISA process. From 2001 to 2003, the number of FISA applications filed 
annually with the Foreign Intelligence Surveillance Court increased by 85 percent. We 
have seen a similar increase in the use of the emergency FISA process that permits us to 
obtain immediate coverage in emergency situations. In 2002, for example, the 
Department of Justice obtained a total of 170 emergency FISA authorizations, which is 
more than three times the number of emergency FISAs we obtained in the 23 years 
between the 1978 enactment of FISA and September 11, 2001. (U) 


qi; | u 
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In the pest year, the FBI produced more than 3 ,000 intelligence products, 


special event threat asseasments, and focused Presidential briefings. We also conducted 
numerous intelligence briefings to members of Congress, other government agencies, and 
the law enforcement and intelligence communities, These efforts mark a new beginning 


for the FBI's a intelligence operation. (U) 
Prior to September 11, 2001, the FBI produced very few raw intelligence reports. 


2 
The majority contained intelligence related to international terrorism; the next greatest 


. seven oonan scala sen ond oybor atlase, Tigua I te ied 


Inabinina to ado reir kinetin nee the FBI has begun producing 
analytic assesements on a par with those of the Intelligence Community, The FBI 
developed and issued, in January 2003, a classified comprehensive assessment of the 
terrorist threat to the U.S. This assessment focuses on the threats that the FBI sees 


. developing over beio teasers Sanat anes atic analysis of information regarding the z 
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within and without the FBI, and as a resource for decision-makers elsewhere in the 
government. The 2004 threat assessment was released in April 2004. FBI imp 
produced over 100 in-depth analyses and several hundred current intelligence articles 
addition to to the work they do assisting FBI investigations. (U) ' 


SY ee cn a eae 
FBI National Report to provide daily intelligence briefings to personnel in the field and 
external customers. One will be produced at the classified level and limited in distribution 
upper-level field managers. The other will be unclassified and widely distributed 

fice personnel and our partners in the law enforcement community. (U) 

A good example of our ability to exploit evidence for its intelligence value and 
share that intelligence is our use of the al-Qa'ida terroriam handbook. A terrorism 
handbook seized from an al-Qa'ida location overseas in the mid-1990's was declassified 

by 


a 
this intelligence. In addition, we used information derived from the al-Qa'ida Handbook 


to update our counterterroriam training, including the Intelligence Analyst Basic Course 
at the College of Analytical Studies, the Introduction to Counterterrorism Course at the 
National Academy, and sessions on Terrorism Indicators and Officer Safety in our 
SLATT training. The unclassified version of the handbook is now maintained as a 
reference in the FBI Library and is accessible to all the students at the Academy. It also is 
included in the reference manual CD-Rom distributed as part of SLATT training. (U) 


One telling measure of our improved counterterrorism operations is the 
development of our capability to brief the daily terrorist threat information. The 
development of this capability reflects the maturing of our ceatralized Counterterrorism 
Program. (Uy 


Prior to Septetnher 110, tha FR Jacked tha capacity to provida scotupevbemsive 
daily terroriam briefing — to assemble the current threat information, to 
cops were boing ten to ares cach hea, ad to prosent a clear picture ofeach teat 


With a decentralized program in which investigations were run by individual field offices, 
the Burean never had to develop this specialized akill. With the nood for centralized 
management, however, it became an imperative. (U) 


Sin sic lt tu halk gu cach cha Smal ta 
White House each moming daily reports on counterterrorism-related events. We had no 


professionals to produce effective daily briefings and to share briefing materials more 
widely within the Bureau and with our partners. (U) 


In 2002 we established the Presidential Support Group within the 
Counterterrorism Division to prepare daily briefiig materials. In the summer of 2003, this 
group was renamed the Strategic Analysis Unit and moved to the Office of Intelligence. 

Beginning in August 2003, the Strategic Analysis Unit began producing the Director's 
Daily Report (DDR), a daily intelligence briefing that includes information on 
ooenketerroripm operations, lorrorism fhresis, and informitioa related to all arcas of FBI 
investigativo- activity. (U) 


To produce the DDR, the Strategic Analysis Unit consolidates and refines 
information provided in a standardized format by intelligence personnel in each division. 
Each morning, information about new threats is added, and information about threats that 
have been thoroughly vetted during the night is removed. The DDR is distributed to 
executives in all FBI operational divisions. The Director uses the DDR to brief the 
President nearly «very weekday moming. The FBI also produces the Presidential 
Intelligence Assessment, a finished FBI intelligence product covering topics of particular 
i ae Ra our personnel st TIC and at FBI 
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Headquarters cintribute to the formulation of the daily President's Terrorist Threat 
Report, (U) 


Director Mueller holds threat briefings twice a day: an intelligence briefing in . 
the moming and a case-oriented briefing in the evening. At these briefings, a briefer and 
the executive Managers provide a summary of the current threats and our 
operations. With CIA and DHS representatives in attendance, these meetings also serve 
to ensure that all threat information is appropriately passed to those agencies. (U) 


The development of this daily briefing operation is a tangible measure of the 


à 


` progress we have made since the day when terrorism investigations were rùn by 


individual field offices and little effort was made to centrally direct o coordinate them 
oe ee the U.S. against - 
terrorism. (U) 


aac EPT er ds T O ergs anil be 
number of criminals it arrested. While useful for traditional law enforcement, where the - 
primary objective is arrest and prosecution, this standard is under-inclusive as applied to 
counterterrorism, where the primary objective is to neutralize terrorist threats. It only 

captures that subset of terrorist threats that are neutralized by arresting terrorista and 

prosecuting them with charges of criminal tecroriam. Fi fails to capture the terrorist threats 
we neutralize through means other than formal terrorism prosecutions - muchas == ` 
deportation, detention, arrest on non-terroriem charges, seizure of financial agsets, and the 


Aes Borel anakun dy OOA we Baro bees in Cop aranes otima Gasos = the 


ist fundraising, 
recruiting, training, or operational planning, Since September 11, 2001, the FBI has 
participated in dozens ofeach operons arptngs wide vatty of Some ed 
international terrorist undertakings. (LU) 


EE EEIE E EE A ANN PE T 
propensi Deaan S o a ee 
mission. The extent of our transformation is most clearly seen in the 
approach we take when conffunting apecifictemorit threat. Owe approach to theee 
operations demonstrates the extent to which coordination and prevention through the 
development of actionable intelligence have became our guiding opertnal principie 
U) 


_ The September 11, 2001, terrorist attacks awakened all of us to the deadly threat 
of modern terrorism and to the need for bold action. We in the FBI have undertaken that 
bold action over the past 33 months. While there is still much work to be done, we have 
made significant progress. With these efforts, and with the unwavering support of the 
American people, we are confident that we will prevail in our war against terrorism. (U) 
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SPECIFIC RESPONSES TO OIG RECOMMENDATIONS: 
A. Recommendations related to the FEI’s analytical program: (U) 


Recommendation No. 1: Improve the hiring, training and retention of intelligence 
analysts. (U) 

Response: E EE O 
training, and retention of analysts sinos the September 11 attacks, 


` The FBI's Office of Intelligence (OT); led by an Executive Assistant Director who 


è Recruitment/Hiring: Prior to the approval of the Human Talent CONOFS the FB! 
did not hawe a recruitment effort specific to the intelligence analyst position. As 

o ‘such, intelligence analysts were not routinely part of recruitment teams. In &n 
effort to ensure the FBI is prepared to meet emerging tecrultment and hiring 


conferences and career fairs throughout the country. From October 2003 - April 
2004, the FBI participated in more than 10 recraitment events and plans to 
participats in at least five additional events through September 2004, (U) 


* A marketing plan was also implemented to supplement the Intelligence Analyst 
recruiting efforts, On February 8, 2004, an advertisement specific to the 
intelligence analyst position at the FBI was placed in the Washington Post, 
Washington Times, and the New York Times, and has since been re-advertised 
several times. On February 9, 2004, the first press release addressing intelligence 
analyt recruitment at the FBI was roleased by tho FBI National Press Office 
kicking off an aggressive intelligence analyst hiring campaign, And, on February 
17, 2004, the second press release was released featuring an interview with BAD 
for Intelligence Maureen A. Beginaki and two FBI Intelligence Analysts. (U) 


¢ In 2004, the FBI revised its hiring procedures for Intelligence Analysts to more 
effectively recruit and hire candidates with necessary critical skills. The new 
system is aresume and weighted question-based system. The weighted questions 
were developed by angen i ge maint 
diet eramen! ino thenteligpne sala palin, ho OL is ootabtiahing 
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education cooperative programs wherein college students would have an 
arrangement to work af the FBI and eam a four-year degree. Students may 
alternate semesters of work with full-time study or may work in the summers in . 
exchange for tuition assistance, The program targets stullents who intend to 


continue working for the FBI for a period of time upon completion of theis 


College of Anslytic Studies: Since Fiscal Year 2002, the College of Analytic 
Studies (CAS) has delivered 13 iterations of the Hasic Intelligence Analysis 


novice anf axpestaacod PII bast gence Analyste, (U) 


264 FBI Analysts have graduated from tho College's ex-week Basic Intelligence 
Analyst Course since ite establishment. (U) 


655 FBI Gold and headquarters Analysis have attended specielty courses on 
variety of topics such as analytical methods, tools, and databases. (U) 


1,389 FBI field and headquarters personnel (Analysts and Agents) have attended 
epeciatized counterterrorism courses offered in conjuction with CIA University. 


ACES I: The Basic Intelligence Analyst Course currently offered by the CAS is 
being revised/updated. Upon completion of this effort the course will be re-titled: 
Analytical Cadre Education Strategy I (ACES I) as outlined in the Hunian Talent 
Conops. The ACES I course will incorporate seven core elements for intelligence 


` writing skills, resources, and field skills. An intermediate course entitled ACES IT 


is anticipated in the future that would target more experienced analysts. (U) 


Mentoring Program: The Ol is creating a career mentoring program to provide 
a eb ga >in ray Er aaa 

Once implemented, all new Intelligence Analysts (new to the position or new to 
the FBI) will have a mentor to assist them. This program will be implemented in 
calendar year 2004. (U) 


Recommendation No, 2: Ensure effective management of analysts, (U) 
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Response: REN sgn ec nec an tid nto mcs ie acted 
Intelligence Analysts receive effective management support and direction. Since 
September 11, 2001, , & number of changes have taken place to improve the management 
program 


inform analysts as to the expectations, but also to keep supervisors informed as to 
-tho proper utilization of the Intelligence Analys! position. -Tho Ol has instructed 

all FBI fisid offices that Intelligence Analysts must report through the Field 

Intelligence Group chain-of-pommand.(U) 


` R AE T PE EER PON EIA E E 
2004. The Ol is responsible for establishing and executing standards for 


divisions based priorities. Operational and field divisions are 
responsible for day-to-day supervision: i Analysts-and-for adhering 
to standards for analyst established by the OL (U) 


® This new management model was implemented byy placing the section chiefs at 
Headquarters currently fractions under the operational 
control of the OL Those section chiefs are rated by the appropriate official in OI 
ee ee re 
integrated, (U) 


Recommendation No. 3: REN KIE E enil EET E botenen tia 
operational and analytical units, w) 


Response: Ths FBI agresa that sù examination of the events surrounding the 
September 11 attacks showed a need for improvement in the coordination between 
operations and analytic units. We believe coordination and consultation has dramatically 
Consistent with the Directors May 2002 announcement of the FBI Strategic 
Focus, the Counterterroriem Division was reorganized to implement a threat-team 
approach to better align the FBI's efforts to prevent terrorism. The revised approach 
moves away from a traditional hierarchical structure and separation between analytic and 
operational functions and employs matrix-management concepts used in successful 
businesses and private organizations and in government agencies. (U) 


The goal of the reorganization was the implementation of an 


structure and concept of operations that empowers and enables the FBI to achieve the 
priority of protecting the United States from terrorist attack by facilitating the flow of 
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information between operational units and their analytic counterparts. ‘The FBI 
St satan rg hag Radical Fundamentalista, Global Extremists, 


, niake nor of weapons o oaa Mainak OMEA wat o IA fU.S. and 


international monetary rules and procedures. (U) 


sing this threat-based framework, the FBI structured the operations of the CTD 
along a sheet paepae ta talc at investigative, financing, reports 


Gach Gebt tour tooo Joowes tb fellate Gay -dny tnecetlenn The components of 


~ Since the September 11 attacks, the FBI's Office o {Intelligence haa published a 


a Stn e aa I e EA wines penean 


The FBI bas put into place a number o of other thochanianne that have vaitty 
improved coordination between operations and snalytic components. These include: (U) 
« Twice daily intelligence and operations briefings chaired by the Director and 

sdcindad te executives, lower-level managers, and line analysts from both the 
operations and intelligence components of the investigative divisions, as well as 


the Executive Assistant Director for Intelligence (EAD-I) and other OI managers. 
Coordination issues are discussed and directions are given for both operations and 
intelligence issues in connection with the priority threats and important 
investigations. (U) 


o A daily Intelligence Production Board (IPB) was established in August 2003, The 


IPB meets daily and is chaired by the BAD-L Representatives include senior 


* 


of all investigative divisions. Coordination issues and processes are 


Suan wel nthe ign en paride 
by the BAD-L (U) 


“ hn Esc hi ng tap MATT notes ANY le oct lea 
Intelligence and Information Sharing. In this capacity, the EAD-I has policy ` 
authority to ensure the coordination recommended dosa indeed take place, and she 
has instituted a number of processes that have-significantly improved coordination 
and consultation between operations and analytic units. (U) 


B. Recommendations related to the FISA process: (U) 
Recommendation No. 4: Ensure adequate training of FBI employees nvoived in the 
FISA process and counterterrorism matters, 


‘The FBI is in agreement with the OIG's recommendation to ensure 


Division (CTD) has made tremendous progress in: developing a training that 
enhances the FBI's ability to conduct- A investi that result in the 
of disruption of terrorist organizations ai networks, and 
has led to an incresse in the overall contribution $f intéllijpence to the U.S. Intelligence 
Community ancl to senior policy makers in government. focuses on all aspects 
of the FBI's response to the threat of terroriam, both end abroad, which 
includes international terrorist in Aa eae of opps domestic terrotism, 
weapons of mass Intelligence 
ravine R poe A Patriot Act, source 
interview and rapid deployment, and digital and electronic 


analytical capsbility to quickly ascertain the reliability, implications, and details of 
Ses Sees ner eee ee eee 
federal agencies. (U) 


CTD's primary focus is to address the most immediate training needs of the FBI's 
workforce. CTD bas been working with the Training Division, Office of Training 


approach gins vit a basie ederraneing of ho foundation of both doment and 
international terrorism aod expands to a specific approach to counterterrorism 
-investigations and implementation of the CT investigative strategy. In-service training 
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dia 
being conducted on a regular bedis include: International Terrorism Basic Operations, 
International Terroriam Source Development, and Interview and Interrogation of Islamic 
Extremists, These training curricula are being developed to moet the needs of the FBI's 
ever changing counterterrorism mission. (U) 
"CTD has developed the course, "Counterterrorism: A Strategic and Tactical 
Approach", to address the overwhelming demand for training of state and local law 


E } . { a 
l ia pescented tngicinaliy and karela ee baar Gaeceominis ilies Malani i6 wia ÁD, 
‘the JTTF, a better understariding of their vital role in the FBI's counterterrorism mission. 


DRT Deepen ee eee Come ary emer E w) 


Throughout FY03, CTD participated in designing a new approach to teaching ` 
w Agents during their four months of New Agent Training (NAT) at the FBI Acadamy, 
December 2002, a plan was designed to incorponite a counterterrorism (CT) and. 
caunerngligenco (Ci instructional bleak into he NAT vo include 110 hours of CT and 
estive dusiion : 


informantocopersiive wiiness/àseet development as well as financial invedtigative 


techniques. (U) 


Enaiirencan ud have bom ondini ey C50) hedad GAC ATAG, 


SSAs, SAS, Analysts and JTTF Officers and have included Suicide Bomber Awareness, 


Terrorist Financing Operations Section to the FBI's law enforcement partners world wide. 
(U) 


The FBI's Office of Training and Development, in coordination with the 
© Division, Counterterroriam Division, and the National Security Law 
Branch (NSLB), Office of the General Counsel (OGC), has prepared and disseminated 


interaotivo "Distans Leaming Program” for New Agen and all other FBT porsona! 


and its impact on investigations, the handling and safeguarding of classified material, and 
the FISA administrative process. All agents and analysts working on counterterroriam or 

| are required to take this distance leaming course. his 
accessible to all employees through the Virtual Academy, the FBT's Learning | 
Management System. The CTD and the Office of Training snd Development have also 
Welo are hg tals Sry AORAR poena A Aapa naa 
addressing the Patriot Act.. (U) 


_ In addition to the distance leaming course, each of the 56 field divisions have 


(CLA) representative. `  pomibla, : 
Policy and Review (OPR) Department of Justice (DO!) tnd FBI Headquarter 
aa e Go initiation of Fi The two-day euricuhmn covered the ent FISA 
the initiation of FISA requests, minimization procedures, and 
penne eee T tls ae au peasions began in July, 2003, st elena 
Noveémber 


Additionally, NSLB assigned two lawyers to support the Counterterrorism 
Division’ s National Security Programs Operational Trainiog Unit (OTU) at the FBI 
Academy. tahoe ese asia herent oga 
Counterintelligence and Counterterrorism instruction. That training is provided by OTU 
and NSLB personnel. (Ù) ` 


NSLB also conducts joint-training with OPR, DOJ, in selected field divisions at 
least once a month. In addition to aix-houre of classroom instruction, several days are 
A er ae ARAETA ca ee a lee ae 
psc WW). 


NSLB further provides FISA instruction for all Foreign Counterintelligence(FCIV 
Counterintelligence (CT)/Intemational Terrorism (IT) In-Service classes conducted at the 


ASACs, Chief Division Counsel, Special Agents, Intelligence Operations 
Intelligence Research Moc did cet A ANEGA MRE AE wanes AINA 
FCUCIIT matters, and for personnel who are transitioning to those assignments. (U) 
. NSLB also provides FISA instruction o to'all FBIH@ operational units as additional 
FCICIIT resources are assigned. NSLB has a newly-created National Seourity Policy 
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end Training Law Unit which, wien ly tafe, will sume brosd vining 
responsibilities for both FBIHQ and field division training in FISA and related matters, 
U) 


The CTD and the FBI's Office of General Counsel, National Security Law 


Spry sidebar provide national security training to field Supervisom and ASAC 
at Department of Justice National Security Training Conferences held at the Department 


of Justice's National Advocacy Center. The NSLB assigned several attorneys as 


instructors to par the conferences which were condita tho National Advocacy 
Center (NAC), DOJ, in pal oti cree The conferences were four days in 1 length. This 
to 


of the F 
Intelligence Surveillance Act (FISA). The first conference was held begiming on May 
2003. A total of six such conferences were conducted at the NAC during the summer 
months, and two conferences were held at Fort Belvoir, Virginia in September 2003, The 
Attorneys, and the attorneys assigned to the Office of Intelligence Policy and Review 
mission and organization of the Intelligence Community, an overview of the Foreign 


iia a aat makia E I KERA day-long, problem-solving 
a E individual "breakout" sections, to reinforce the teaching objectives 
AEE 


ty 
mDAN aie KOASAS MA tices Sons satu POLMA MAE Based on the 
success of both conferences, CTD implemented and developed a a regional training course 
to guide all 56 56 Field Divisions on the Attorney General Guidelines for National Security 
Investigations and the FISA process. (U) 

The Counterintelligence Law Unit in NSLB routinely participates in country- 
specific conferences that Counterintelligence Division units sponsor (usually on a yearly 
basis). The topics taught by NSLB include the National Security Guide lines and the FISA 

process. (U) ' 


pane 0/11 "Bais phe National Security Lew Unit) provided extensive 


NELU provided intelligenoe low trainiag Sor Chief Divicioa Cottnes! et three regional | 


beeing cen cman fy 1996 w4 1997 ripen Bioanal Cy cn RENO kar innan, 


NSLU ao rot provid insligenoo aw tninng at oonferenes sponsored by the 
| Counterterrorism Section. (U) 


sii d pewiidon PEA iaria dalian sli pda 
disseminated to all divisions: e.g., NSLB guidance entitled "Intelligence Sharing 
Procedures for Foreign Intelligence and Foreign Counterintelligence Investigations. 


ee ee eee all field divisions in November 2002. 
wu) 


NSLB sto maintains tho OGC Intrenet (svailablo to HQ and al field divisions) 
Recent instruction included specific guidance on information sharing. The 

a a a catitled “How Do T Geta ; 
FISAF (U) 


With regard to YO raising, CLD wil! continus to ‘chs ead PRACT 
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CTD has developed a Counterterroriam Training Track to address the most 
educational nesds of Agents, Analysts, and JTF Officers assigned to. 


counterterrorism related matters, starting with a basic understanding of terrorist 
operations and moving on to intermediate and | more advanced levels. (U) 


Speci sourse dealgned fr ha Basio lve of tistaing fhe Agenta, Analyste, snd JTIF 
Officers include: (U) 


* International Terorism Basic Operations - approximately 850 trained. (U) 

International Terrorism Source Development — approximately 300 trained. (U) 

+ Counterterrorism: A Strategic and Tactical Approach- approximately 210 plus 50 
instructors trained. (U) 

. Domestic Terrorism — - approximately 39 trained. (U) 

* Middle Eastern Culture/ISLAM 101 — online course (U) 

» CT Training for State and Local Law Enforcement — 130 Agents trained aa 
instructors for 26,880 law enforcement officers.(U) 

* The College of Analytical Studies offers a series of courses for analysts that 
support the CT mission - approximately 250 trained, (U) 


è IT Interview and Interrogation — new intermediate course for summer 2004 for 40 
agents.(U) 


a 26 


e Specialty topics including courses on the Arabian Peninsula and Hamas — 
approxiznately 100 trained. (U) 

` CTD works in colleboration with the CIA Univernity offering specialty courses 
mainly focused on WMD issues — approximately 22 trained. (U) 

® Digital and Electronic Evidence Exploitation — approximately 80 trained. (U) 

a Internet and Email Communications Investigation — approximately 40 trained. (U) 

o Suicide Bomber Awareness Training — approximately 320 trained. (U) 


Courses designed for the advanced level include: (U) 
e Interview and Interrogation Techniques-. 19 agents trained at the advanced level in 
Israel. (U} 
® Development and Handling of Islamic Extremist Sources — 39 agents trained at 
the advanced level. (U) . 


Tho FBI's Senior Bocutve Service personnel are going through an exeontive 
. one-week 
Ogea, SBT ainectives spars galdanos on semenaing changa, Wik s pertenier Sions an 


the FBI's transition to new intelligence, investigative, and case management processes. 
As of February 13, 2004, 260 FBI executive managers have completed the training, 


"© including 12 Assistant Directors and 54 SACs. (U) 


The following chart depicts the Counterterrorism Division projected training for FY 2005: 


> 


COUNTERTERRORISM TRAINING STATUS FOR FY2003 


Future Courses in Development: 


e Overseas Deployment — Survival Training for Overseas Deployments in hostile 
environments (U) 


a ri A Support Reports Officer Training at least once per quarter/2.5 
e ASAC/SSA Training — FBI/CIA Partnership, Specific Topics, Operations and 
Mianagematet, Gaast Sponka for ERs onos/manth. (U) 


* Chins Coubies — OEN which oounee information adagta easily to caline 
Virtual Academy sponsored by the Training Division. (U) 

« WMD and other specific International Teroris: Group Counterterrorism Training 
(U) 


: FBI Attorneys should be better integrated Into 
counterterrorism Investigations. (U) 


FBI Response; After 9/11, the National Security Law Branch (NSLB) was restructured 
go as to mirror the operational strecture of FBI Headquarters. Reflecting the operational 
division between the Counterterrorism Division (CTD), the Counterintelligence Division 
(CD), and the Cyber Division, three units were established within NSLB — two tò haridle 
counterterrorism matters (Counterterrorism Law Unite (CTLU) I and M), and one unit to 
handle counterintelligence and cyber matters (Counterintelligence Law Unit (CILU)). (A 
fourth unit has recently been established to focus upon policy and training issues.) - 
Within each of the three operetionally-focused NSLB units, the attorneys are asiigned to 
particular units or sections within CTD, CD or Cyber. Further, with regard to 
International Terroriam Sections I and H of CTD, NSLB has assigned two attorneys to be 
co-located in client spece. (U) 


Thus, with the sssignment of an altomey to each of the operational units or 
sections, there is routine contact between agent, analyst and y on legal issues that 
arise, With regard to review of FISAs, NSLB attorneys have sp and focused 


approving the initiation submitted to him by his client, the operational unit. Any 
subsequent issues concerning that FISA which come to the attention of the operational 
unit with responsibility for the package is then routed to the attorney assigned that unit. 
The long-term result of this arrangement is an increased familiarity between client and 
counsel, and en improved working relationship. A sense of trust and purpose develops 
between the parties which greatly increases the likelihood that legal assistance will in fact 
be sought when it is necessary, and it increases the effectivences of the attorney in 
responding to requests for legal assistance. Furthermore, the historic knowledge that the 
attomey gains by being assigned to a particular unit also increases his effectivencas, 
inasmuch as be has both present and past familiarity not only with the particular 
investigation that is the subject of the legal request, but with related investigations and 
the subject matter in general. (U) 


The creation of new units within NSLB which have specific responsibilities for 

CTD, CD and Cyber units and sections has also increased contact with the field. NSLB 
attorneys have the opportunity for increased interaction with the field agents who are 
handling the investigations that are being supervised by the substantive units to which the 
eee re eee nc tee ne 

ons requiring an immediate response or information needed by the NSLB attorney, 
aride issue ie the sufficiency or completeness of a request for FISA initiation, 
the NSLB attorney and the field agents have refined their working relationship, whereby 


the NSLB attorney knows whom to tum to get answers to his questions, and the field 


agents know whom to sesk out in order to resolve legal issues, (U) 


_ Additionally, in the near fiture, NSLB will be further integrated with the 
ie mogi cang arae reoi erp intr dl aa 
in Tysons Comer, Virginia, The FBI, CIA, DOJ, and other agencies'of the U 
nl gece Comma will bso etd for tha it ine lg mb in a singl 
facility. At present, a a total o eS move to the new 
facility in Virginia. We expect that this move will result in a ca gs fNSLB 
attorneys into counterterrorism i investigations. (U) 


Recommendation No, 6; R E O E 


k particalariy on important or unusual cases. (U) 


Response: The FBI is in agreement with OIG’s recommendation to to coordinate closer - 
with OIPR, and bas takea steps to ensure that this is accomplished. feng 


in tt 
end GJ ongsing inteligence operations ocd Gough OIPR, were in sync. 
Attendees at the weekly meeting include the ITOS I Section Chief or Assistant Section 


Chief, cach of the four ITOS.I Unit Chiefs or their representatives, and representatives 
from CTS and OIPR. During the mecting all entitics feld and ask questions, resolving 
most issues in the room. Typical issues include the statan of high-visibility investigations 
in the field, the status of pending requests with OIPR, ne Wen sees Go een 


FBI Field Divisicms on those issues under the program menagement of ITOS L w) 
ITOS I representatives were also heavily involved! in the writing of the FISA 


i Thi eyan AA provide a vehicle for FBI/OIPR prioritization of FISA 


teen texte PENER PE AEE TE aa ja 
search packages, Standard Minimization Procedures, interpretation of the FISA statute, 
and myriad other matters. More specifically, there arg biweekly meetings between OFPR 
supervisors and OA T Ciaran aap beep ka 


dialogue betwoen the FBI and OIPR, at all eves, on important and unusual cases. (U) l 
On April 5, 2004, the Attorney Goneral directed OIPR and the FBI to ) implement 

certain changes in the FISA process. This included the assignment of five NSLB 

attomeys to bene epia alee cor to the "Intemational Terrorism 


eS bk ipa ndhaci ny eg irr bry S ae Oaa ier 


SO , "CS Sandie: iil is in ts iaa il i aaa 
Community: (1). 


l Recommendation No.7: Ensure effective management of FBI detailees. (U) i 
. The FBI is in agreement that the O 1G’s recommendation to to provide effective 
to 


ETE the FBI and CIA Ss, Ean A Dahad IE AAAA een 
detailed, with the SES manager being their ultimate rating official. ee enres 


mS been made aware of their duties and responsibilities within their specified area of 


operation and this has been documented accordingly. In addition, all CTD detsilees 
sail to the CTC meet daily with the SES manager, and the GS-15 Supervisors meet 


wali GS-14 Sree fe em inclusive to 


e In addition, the training curriculums for both New Agents and Intelligence 
Analysts is being revised to improve the knowledge that FBI employees have 
about U.S. Intelligence Community agencies, their roles, capabilities, end basic 
processes. (U) . 


© The Office of Intelligence has posted a Pga te of the vations types of 
intelligence reports produced by the U.S . Intelligence Community on its FBI 
intranet website. (U) ' 


"é A senior CIA official has been detailed to the FBI's Counterterrorism Division to 
enhance the FBI's knowledge of CLA counterterrorism operations and improve 


coordination. This official attends the daily briefings described earlier, where he 
discusses key Kas EX boania alee and aAA Na accdionen EA 
the two agencies. (U) 


i n 


: Provide guidance for how nmd when to document 


Recommendation No, 2: 
intelligence information received from Informal brieflugs by other mage 
agencies. (U) | 


Response: This FER iae tain Gioii i advtooeatcit lets 
continuing development of intelligence policies and procedures, We note, however, that 
at the time of the verbal briefings by the CLA on Mihdhar around the time of the 
millennium threat, FBI policies to record this information did exist, They permitted the 
recording 


of this information by the FBI employee(s) in en Electronic Communication 
(EC), classified appropristely, and directed to the relevant file(s). (U) 


Ensure that the FBI's Information technology systems 


Recommendation No, 1(: 
allow FBI employees to more readily receive, use, and disseminate highly classified 
information. (U) 


The FBI hes a responsibility to the nation, IC, Federal, State and Local law | 
enforcement to disseminate information and to do so is an inherent part of its mission. 
Sharing FBI information will be the rule; filtering the information will be the exception, 
. where sharing is legally or procedurally unacceptable. The FBI will deliver its 
information through the systenis the FEY and its customers and partners use. (U) 


; ¿The FBI is connected to the rest of the U.S. Intelligence Coriimunity at the Top 
‘Soave (15) Save Conenrtnened Ineas ton (SCT) orl via fta now SCI 
. Netexalt (DERN) The ECION penfeck wen Ration in Giese, 2001, 
budget and pe 


SCION is currently available to over 1000 users at FBI Headquarters, and the FBI 
has initiated a pilot deployment project to the following Field Offices: New York, Boston, 
and Kansas City. The plan is to deliver SCION to all FB] Field Offices, as funding. ` 
becomes available. Limited access to Intelink from other Field Offices is available 
through the old FBI Intelligence Information System Network (IISNET). Most of the 
Field Offices have two workstations which have a connection to FB] headquarters, These 
workstations. are inadequate and difficult to use, and they are located in small Secure 
ee ee re ee ee ee eee eee 

to field expansion of SCION is the lack of SCIF space for the Field 


ariaa Groups (FIGs) and the Joint Terrorism Task Forces (JTTFs) personnel, (U) 
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` =- Aeeeas to to the intelligence and homeland security communities at the SECRET 
- level is provided via the Department of Defense SECRET Internet Protocol Router 
Network (SIPRNET) which provides the communications backbone to INTELINK- ` 
Secret. Our goal is to provide SIPRNET/INTELINK-Socret access through secure 


Sethe acs of T EE EE E lamnalnateritf official j 
information and teskings to other agencies, the FBI lias just implemented its mew FBI 
i eck ee sarap mere 


wil provide tee xe aeryen on STON SNE yn fs oe. - 


oot en AEDE O Dion en aT 

users, The sysiera wili permit multi-media attachments to Sompnagittend points iiio- 

end security. (U) 
eeni 

renee programs aa part 


of jenignes tatiana actioned Anina, nod Ths eo bee publishes on Pa: gh 


web sites connected tp SIPRNET aiid SWICS. The first FBI TS/SCI IC Data Mart 
(CDM) is currently in pai emia roamed os £2004. The FB] 
Chief Information Officer is also working with the Department of Justice on interfaces 


production of intelligence reports. The FBI is applying XML data standards and meia- 
data tagging to facilitate the exchange of information with the intelligence community. 
Tha Ee da aled aggihying naw soutiy Racing © diglog a Piolla Level 3 Dats 
Mart capability with discretionary accesa controla and Public Key Infrastructure 
certificates in support of closed Community of Interests which will permit secure sharing 
of our most senaitive data with trusted members of other agencies, The FBI is also 
investigating the use of secure one way transfers to move information between security 
domains and to permit all-source intelligence analysis, The use of next- 

earetan hem stinery A a hain hg 
intelligence to deployed personnel. The FBI is also starting to use On-line, deaktop 
-collaboration tools such as Info Work Space which is the foundation for the Intelligence 
Community Collaboration Portal to increase intelligence collaboration. (U) 


The FBI plens to use additional systems as the foundation for additional information 


The CJIS National Data Exchange (NDEx) has plans for developing a systems 


_ . approach to the operation, and maintenance of several interconnected IT and supporting 
telecommunications systems 


including Law Enforcement On-line (LEO) and CJIS WAN. 

‘Fhe NDEx isto boa repository often! nos and a Pointer rye for 
state/local/federal and inter-governmentel law enforcement entities. The NDEx will also 
pap a a ra 
certain national security data. (U) 
=> Lew Enforcement On-Line provides web-based communications to the law 
enforcement community to exchange information, conduct on-line education programa, and 

in inierest and topically focused dialòg. The system has been 


agencies and to 60 federal agencies, and providing information about terrorism, criminal and 
cyber threats to patrol officers and other local law enforcement personnel who have direct 
daily contacts with the general public. The FBI plans to enhance LEO for robust, high- 
availability operation. The FBI will use the enhanced LEO as the primary channel for 
sensitive but unclassified communications with other federal, state and local agencies. LEO 
and the Department of Homeland Securities Joint Regione! Information Exchange System 
(JRIES) will be interoperable. (U) 


The Investigative Data Warehouse (IDW) is following  multiple-phased approach l to 
quickly provide support to FBI investigators, i Taik Patt ibe kao bet sta 
spirally-developed operational prototype system, the Secure Counterterrorism : 

Prototype Environment (SCOPE). The enterprise system which builds upon SCOPE is the 
IDW system; the fall deployment of IDW is scheduled for December 2004, The IDW will 
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help meet the law enforcement and the IC need for rr dar e iia indexed data 
ee a FBI investigative files. (U) 


a The Multi-agonoy Information Sharing nitive in intondod so to enabie P Federal, state, 
and local law enforcement agencies to iav seen eevee eve h ea and provide powerful 


With the creation o {tte Oe cntelignce st the FBI, each FBI: field office has 


l established a Field Intelligence Group (FIG). It is the responsibility o Aerea to manage, 


executo and maintain the FBI's intelligence fimctions within the FBL FJG personnel have- 


mo of sie oases io T5 fad OC filamation go Gag WIE ba dhia ba topete, sae, varirao 
recommend sharing this information with entities within the FBI as well as our customers 


se pigeon pn ak Dc pe Taa eae ema) 
« s i : , $ 
offices to handle highly classified information. (U) | 
TH FBI agrees with the recommendation and has takon siepe to address the issue. To 
the Bureau's increased demand for acccas to Sensitive Compartmented 
Information (SCI) systems the following actions have been taken: (U) 
1) Large SCIFs aro being designed and incorporated into new FBI Facilities. 


`. This will allow field offices investigative and intelligence elements to be located in areas. 
Se ee ee eee ne eee 
information systems. (U) 
2) In addition, ten (10) field offices, including the New York Field Office 
mentioned in the above finding, have been identified as thoge that are most in 
n © need of SCIF upgrades. Associated costs include construction costs and 
miscellaneous costs. Miscellaneous costs include Eagle phones (1 per person); 


secure phones (1 per 10 people); shredders (1 per 10 people); and secure fax 

machines (1 per 30 people). This information was provided in response to 

Questions for the Record which followed from the March 30, 2004 testimony 
I 


5) tet currently implementing a plan to adhere to the National Security . 


‘Aine mandato to havo ll STU instruments replaced wit TBs by 2005 


. 


a 
Recommendation No, 12: Improve dissemination of threat information. (U) 


Response: The FBI agrees that, like other intelligence and law enforcement agencies, 
it needed to improve in every way possible the processes used to disseminate threat - 
information. Since September 11, 2001, the FBI has issued clear guidance for the 
dissemination of threat information. Additional policy development and training 
initistives are in progress to further strengthen the FBI's threat information di 
processes. Bolow are the stepa fha FEU has tskan: (U) 


a Às indinatod airiai ihe FETs RAD, a sniod Intlliguave Comminity camaat 
professional, has established concepta of operations, policies, and procedures 
related to the dissemination, both internally and externally, of threat information. 
w) ; 


« In December 2003, an EC was distributed to all Field Offices and Legats, entitled, : ag 


intelligence collection, and emphasized threat information reporting and: 
dissemination procedures. (LU) 


« - The FEI has prepared and distributed standing and ad-hoc sets of i 

requirements (intelligence collection and reporting guidance) for agency-wide use. 
These requirements are posted on the FBI intranet and available to all employees. 
and 


instructions, to include reporting formats and to what components the threat 
information should be reported. (U) 


L 


a The FBI has developed and pleated a two-week spoolalized taining ome 
| This 


a The FEI is nearing completion of the development of a new web-based 

. Intelligence Information Report (IIR) application, which will serve to vastly 
improve the efficiency and effectiveness of reporting and disseminating threat 
information. The new application will contain a single IMR format for use 
throughout all of the FBI's programs, and will have a number of advanced 
features, such as electronic approval, date and time stamping, work flow tracking, 
and standard dissemination lists. The application will be supported by a 
comprehensive IIR handbook which will be distributed throughout the FBI in 
June 2004, (U) 


a 37 


The National Threat Center Section (NTCS) is the Counterterrorism Division's 
(CTD) focal point for the receipt, preliminary analysis, and assignment for immediate © 
action of all emerging International Terrorisin (IT) and Domestic Terrorism (DT) threats. 
The NTCS coordinates these threats with several entities and agencies, to include the 
Terrorist Threat Integration Center (TTIC), Terrorist Screening Center (TSC) and the 
Foreign Terrorist Tracking Task F Force (FITT?). u) 


The NTCS is comprised of ve units: CT Watch (CTW), Public Access Center 
Unit (PA! aA Weer AA OA tannin Terrorist Watch and 
` Waming Unit (TWWU), and Threat Monitoring Unit (TMU). TMU and CTW are 
responsible for most interfacing with TTIC, rai namie (u) 


The mission of TMU is to support the FB's role in defending the United States 
from the threai: of terrorism by receiving, assesajng, disseminating, and memorializing 
threat information and suspicious activity in conjunction with FBIHQ, FBI Field Offices, 
Legal Attaches, and the U.S. Intelligence Community (USIC). (U) 


se eed sree s e e anre pariak pa panay aene paea e Agrat 
personnel. TMU immediately insures the appropriate FBI substantive units, Joint 
Terrorism Task Force (JTTF) agencies, or other governmicnt egesicies,-are expeditiously 
apprized of the threat information, and makes a record of this threat information referral. 


During fiscal year 2003, TMU received and assessed approximately 11 11,000 threat 
and suspicious activity referrals. DE ea es ee 700 


Over 300 individualized searches of the TMU threats database were requested of, 
’ ind conducted by, TMU to facilitate threat trend analysia by FBI units, the Department of 


Homeland Security, the National Infrastructure Protection Center, and other agencies of 
the USIC who are seeking to measure target vulnerability. Also, in 2003, over 200 


requests for, and conducted, more than specialized threat database searches for 
major events (i.e., mapas ere Bacan wet Mie gees es ae to Goes 
corresponding with religious celebrations. (U) 


Counterterrorism Watch 


All TTIC personnel with access to FBI intemal e-mail have been granted proxy 
rights to the main CT Watch e-mail folder and the CT Watch Daily Log. Many new 
issues and updates are reported to CTW by e-mail. hepatoma ag beer arg 
calls, faxes, teletypes and e-mails are documented, in detail, in the Daily Log. Through 
this unlimited, real-time access to both the e-mail and log, all information reported to CT 
Watch is also available to TTIC. Furthermore, a CTW analyst is physically assigned to 
TTIC where they serve in a liaison role, ensuring information is shared between the FBI 
and TTIC. Conversely, CTW personnel also have access to TTIC Online where TTIC 
records all new threat information and provides updates on current threat investigations. 
In the late summer to early fall of 2004, CTW wilt be relocated to a new building and, as 
such, will be physically collocated with TTIC. (U) 


sat 
si: The TSC initially receives an inquiry from a law enforcement agency subsequent 
towViolent Gangs and Terrorist Organization File (VGTOF) record match. The TSC 


communicates with the inquiring law enforcement agency to provide direction and 


confirm a match on the subject(s).- If a possible match is made, the TSC generates a 
report containing all pertinent biographical deta and a checklist of any research conducted. 


l The TSC then muksa direct confact with tho CTW via talephone and/or secure faceimile 


to provide the information regarding the possible match. (U) 


Upon receipt of the telephonic notification from the TSC, an analyst from the — 
CTW will review all identifying information regarding the possible terrorist subject and 


_ confirm any database searches already conducted by the TSC, such as National Criminal 


additional database searches to include: je: amore detailed ACS sare, Telephone 
Integrated Intelligence Information Application, Treasury Enforcement 
Communication System, Watchlist, Department of State, Immigration and Naturalization 
Service, Transportation Security Administration, Bureau of Prisons, INTERPOL, and 
pertinent public databases such as ChoicePoint, AutoTrack, and LexisNexis. (U) 


The CTW analyst provides a brief synopsis to a CTW Agent, who then 


- coordinates reactive and investigative action with the field via the FBI JTTFs,,. 


Field LEGAT Offices, FBI case agents, and/or FBI ‘Airport Liaison Agents. The CTW 
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disseminates the infortnation to all relevant agencies and coordinates final resolution 
directly with the ITTF. When confirmation regarding tho final resolution is received 
from the JTTF, the CTW provides a summary of the encounter in the CTW/TSC Group 
Daily Logs. Tann TOE at can Laa Oa OSA OANA COE Oai e SNA 
locations, identifiers, call-back numbers, and a description! of how the matter was 
resolved. The log entries are read in real time by FBI personnel at the TSC in Crystal 
City, Virginia, and used to document a final resolution for the encounter and "close the 
loop." The TSC pg gata tap crema np re 
information beck to the respective agency that nominated the terrorist-related subject for 
inchusion into the VGTOF database (TTIC or FBI). W) 


` A representative from the FITTF has been assigned full-time to CTW. 
Additionally, under the new CTD organizational chart, FTTTF has been placed under the 
umbrella of the NTCS. This collocation of resources will facilitate the flow of 
information between the NTCS and FITTF. (U) 


D. Othar Racoraiyontationn 


Superior Spal Agents trough the FBI Headquarter 


at FBIHQ have on average served aa investigators for 10.5 years prior to assuming their 
management positions. GS-14 SSAs currently serving ai FBIHQ have on average 2.43 
years in their FBIHQ SSA positions, FBIHQ SSAs are in fact required to complete at 


emerging threats over. the long term. However, it is not accurate from the perspective of 
the FBI to characterize a two-year commitment to an FRJHQ position as a “rapid 
rotation,” implying that SS.As on these two-year assignments contribute at.a lesa then 
optimum level to the FBI's counterterrorism mission due to their length of service. The 
intention of service at FBIHQ is to provide Bureau leaders, selected on the basis of their 


scale, First line managers, working with their more experienced superiors and supported 
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address emerging trends. These FBI Aia eoni siin dis eine i 


ey CA Aana Ia Aa DON DEAE On A D of the FBI's 
mission. (U) 
hehe teen PORRE E tol E EE 
: cadre, it Se EA y eee 
ihanantvan of da miea posli range of leadership challenges, most particularly those 
available in FBIHQ SSA positions. The FBI's Executive Development and Selection 
Program has sought to strike the appropriate balance between providing first line 
managers with a range of developmental opportunities, and thereby address leadership 
succession concems, while still providing continuity in the management of priority 
approaches of new fire line managers. (U) l 
Recommendation No, 14: Provide guidance on the type of information that agents 
should obtain for evaluating assets and for documenting the yearly check on assets. 


ni Pagparito paeran arpon ay bre 


depending on the type of asset being developed or operated. The NFIPM Section 27-26.. 
establishes 12 points which must be addressed in each evaluation. Among the twelve 


points are: 1) accomplishments attributable to the asset, 2) a characterization statement of 
thestiset, and 3) the amount of money paid to the asset. Tho annual evaluation is not 

intended to document the asset's bona fides, NFIPM Section 27-29 provides examples of 
teats that the handling agent might utilize to determine the asset's bona fides. Additional 


the asset's reliability and veracity of the information they provided. These areas of 
reporting lend themselves to the administrative facet o aie ier ee oe 


ENE EIA BEEE E EA E ME PN is EA AE 
required to submit a case agent assessment to FBIHQ. This assesement is a brief _ 
narrative based on the handler's observations of and interestions with the asset, and 
provides insight into an asset's motivation and control, beliefs, habits end any significant 
behavioral changes. This time table does not preclude the agent from submitting 
revised case agent assessment in the interim if the asset's behavior changes significantly 
Additionally, a revised version of the NFIPM section 27 is currently in the draft stage. 
The new NFIPM will include language that directs agents to notify their immediate 
supervisor if they identify a significant change in the asset. The SSA will then determine 


if the asset's behavioral change rises to a level which would require FBIHQ notification. 
u) 


EINN 
Ge coches E E O E E EE E A 
-in nature, and depending on the information's bearing on tho investigative program, may, 
_ fequire followup. These areas of reporting lend themselves to the investigative fice of 


asset development end operation. Further, this facet of asset development and operition 


are dictated by the logical progression of the a come te ae 
to or defined in administrative policy. (U) 


Improve the Mow of intelligence Information within the 
. W- 


3% “qe FSI hiss «redponetiy tothe nation IÈ Pedr Stato ad Loca hr 
enforcement to disseminate information and te do so is an inherent part of its mission, 
Sharing FBI information will be the rule; filtering the information will be the exception, 
where sharing is legally or propedurally unacceptable. The FBI will deliver its 
information through the systems the FBI and its customers sind partners use: (U) 


The FBI is connected ta the rest of the U.S. Intelligence Community sf the Top 
i Information sci 


SCION Ip cujintty avilable Yo over 1000 woére ot FBI Hondawactecs, tid the FBI 
has initiated a pilot deployment project to the following Field Offices: New York, Boston, 
and Kansas City. ‘The plan is to deliver SCION to all FBI Field Offices, as funding 
becomes available. Limited access to Intelink from other Field Offices is available 
through the old FBI intelligence Information System Network (IISNET). Mostofthe — 
Field Offices have two workstations which have a connection to FBI headquarters. These 
workstations are inadequate and difficult to use, and they ars located in small Secure 
Compartmented Information Facilities (SCIF) that are not in the agent or analyst wotk 
areas. An impediment to field expansion of SCION is the lack of SCIF space for the Field 
Repel pace ape Se) ne ee TAES Taek Pores ETTEN peepee (C) 


Access to the intelligence and homeland security communities tt the SECRET 
level is provided via the Department of Defense SECRET Internet Protocol Router — 
Network (SIPRNET) which provides the communications backbone to INTELINK- 
Secret. Our goal is to provide SIPRNET/INTELINK-Secret access through secure 
dynamic virtual private networks to al] FBI workstations in the near future. Today you 
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Recommendation No, 15: 
FBI and the dissemination of intelligence Information to other intelligence sen 


f me 


; cannot direotly access any externat networks from the FBINET and only limited batoh 


Hides tho SIPRNBT comacenloetions Biskonè tnd provido boininals sad socom aaa - 


used to support the Terrorist Explosive Device Analysis Center, the National lat | 


Translation Center, and the Foreign Terrorisin Tracking Task Force. (> 

I hib a a of odliotal 
information and taskings to other ageticica, tho FBI has just implemented its new FBI 
Automated Messaging System (FAMS) which is based on the Defense Messaging 


System (DMS). The FBI is the first civilian agency to operate the.classified DMS. 

‘AMS will provide on-line message creation, review, and search capabilities to everyone 
connected to FBINET. FAMS gives us the capability to send and receive critical 
organizational message traffic to any of the 40,000+ addresses on DMS or Automated 
Digital Network (AUTODIN). The TS/SCT version of FAMS is currently in testing and 
will provide the same capability to everyone on SCION or IISNET by the end of this year. 
The FBI's impiementation of the DMS will provide writer-to-reader secure e-mail to 
intemal and external users. Within the government, DMS will replace AUTODIN and a 


acne bagel a use throughout the Department of Defense 


sequre e-mail system. sci a A iena a f various commercially 


users. The system will permit multi-media sttachments to messages and provide end-to- 


, eat ony) 


- In the area ò of connectivity for data products, the FBI is just beginning to 


the FBI 
Criminal Justice Information Services (CJIS) Division to increase the sharing of 
intelligence related information from and to state and local officials. (U). 


‘The FBI is currently deploying the SECRET versions of FAMS, which uses DMS 
sid ariaa Oaai Whee Ga We oai aA, Sagna upsa 
reports o officers can ed and recive Snel intelligence with ther agence in near real 
time, The FBI is also working on a digital production capability for IRs using extended 
markup language (XML) that will interface with FAMS and support on-line digital 


advi nisp datingan deee ari baean 
certificates in support of closed Community of Interests which will permit secure sharing 


of our moet sensitive data with trusted members of other agencita. The FBlis also 
investigating the use of secure one way transfers to move information between security 
domains and to permit all-source intelligence analysis. The use of next-generation, 
community High Assurance Guards is being planned to provide for the two way transfer 
on critical intelligence between security domains. Socis wireless connectivity and 
Virtual Private Networks are also being looked at to provide increased access to 
intelligence to deployed personnel. The FBI is also starting to use On-line, desktop 
collaboration tools such as Info Work Space which is the foundation for the Intelligence 
Community Collaboration Portal to increase intelliganca collaboration. (U) 


Tho FB plins to uso adtnal toms as fho founaon fr sna information 
sharing with thë IC, Federal State and Local entities. (U) . 


The CIIS National Data Exchange (NDEx) has plans for developing « systema `- 
approach to the operation, and maintenance of several interconnected IT and 
telecommiunications systems including Law Enforcement On-line (LEO) and CJIS WAN. 
Tiss PIDAK fo Bara decay oT andoni ees eae pokdir siaa ke i 
state/local/federal and inter-governmental law enforcement entities. The NDEx will also 
Da3 alec pide i is oucesatiog i aaay bani pein Jaion iair ei 
certain national security data, U). 


seine A" Batoroement OnLine providos web-based communications tothe ew 
enforcement community to exchange information, conduct on-line education programs, and 
_ participate in professional special interest and topically focused dialog. The system has been 
operational since 1995 and presently serving about 30,000 users, LEO has secure 
connectivity to the Regional Information Sharing Systeme network (riss.net). -The FBI 
Intelligence products ere disseminated weekly via: LEO to over 17,000 law-enforcement 
agencies and to 60 federal agencies, and providing information about terrorism, criminal and 


availability operation. The FBI will use the enhanced LEO as the primary channel for 
sensitive but unclassified communications with other federal, state and local agencies. LEO 
eo ee A 
(JRIES) will be interoperable. (U) 


The Investigative Data Warehouse (IDW) is following a taalipto-phasod approach io 


IDW system; the full deployment of IDW is scheduled for December 2004, The IDW will 
help meet the law enforcement and the IC need for rapid, secure, dependable indexed data 
and will provide data mining acoess to FBI investigative files. U) 


The Multi-agency Information Sharing Initiative is intended to enable Federal, state, 


and local law enforcement agencies to share regional investigative files and provide powerful 
tools for cross-file analyses. A proof-of-concept effort ia underway in St. Louis; additional . 
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———value of which cen be analyzed by modem softwere tools; and (2) 
systems. Final 


help define technical and organizational epproaches for regional shared 

decisions about deployment of the MIS will be based on the results of the demonstrations and 
the department wide plan for law enforcement information sharing being developed by the 
Department of Justice. (U) 


With the creation of the Office of Intelligence at the FBI, each FBI field office has 
established a Field Intelligence Group (FIG). It is the reaponsibility of these FIGS to 
manage, execute and maintain the FBI's intelligence functions within the FBI. FIG 
personnel have routine access to TS and SCI information so they will be able to receive, 
analyze, review and recommend sharing this information with entities within the FBI as 
well as our customers and partners within the Intelligence and Law enforcement 
communities. (U) 


: Ensure that field offices allocate resources consistent with 
FBI priorities. 


The FBI agrees with the general concept that the recommendation is based upon 


and has in fact instructed each field office to address higher priority matters before lower 


ones, ‘The Director has instructed the field offices to use whatever resources are 
necessary to handle-all Counterterrorism leads. However, it must be pointed out that the 
level of resources allocated to each priority is not based upon the relative rank of the 
priority but upon the level and significance of the threat in each priority area and the 
extent.to which the FBI has sole jurisdiction over the matter. Thus, to determine that the 
appropriate level of resources is allocated to each priority, a simple formula cannot be 
used.-«A. detailed analysis of the threat and workload in every FBI division must be 
conducted. 


This analysis of the threat and workload is conducted by cach FBI program as part 
of the FBI's resource allocation process. In addition, the FBI has developed and 
implemented semi-annual program reviews to ensure each field office is appropriately 
addressing the FBI and the national program priorities. Headquarter’s program managers 
are required to review cach office's program review submission and make appropriate 
management decisions. In addition, the FBI's Inspection Division will use the semi- 
annual review submissions as a source document of conducting the field office 
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EE EE EEEN not addressing matters sippropriately, the 


priority matters a 
Inspection Division will a “finding” and require a convective action be taken. The 


. Inspection Division will also‘ review the actions of the national manager : 
ensure that appropriate instruction A AA, Pane E 


haay 7. 
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